Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
docx.msi
Resource
win7-20241010-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
docx.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
docx.msi
-
Size
1.7MB
-
MD5
904ac94be4b6b3e1a4bf741d80401879
-
SHA1
bfd7f9e4bb42f54c02c4933439c9e90b8c975299
-
SHA256
fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648
-
SHA512
c2ff2e02c00e485e3551c6a8b3451cf227f8317e4b908b4fe1202337288937cebffbdbd2f5bc5ae33326ef9e14e9f8c18563bdfe3d6d5c9dad7413b96fbd31e9
-
SSDEEP
49152:PEVnsHyjtk2MYC5GDFhloJfjQiCSAKyHI9K9:mnsmtk2aAhl0RC1g
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TGWEKK.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIF3E2.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\TGWEKK = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\XVZBZS.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1384-142-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-143-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-145-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-147-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-149-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/272-153-0x0000000000D90000-0x0000000000F8A000-memory.dmp autoit_exe behavioral1/memory/1384-163-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-167-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-188-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-197-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-199-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-201-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/2192-204-0x0000000000080000-0x000000000027A000-memory.dmp autoit_exe behavioral1/memory/1384-206-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-208-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe behavioral1/memory/1384-210-0x0000000000C00000-0x0000000000DFA000-memory.dmp autoit_exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_MSIF3E2.tmp MSIF3E2.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSIF3E2.tmp MSIF3E2.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe -
resource yara_rule behavioral1/files/0x00080000000194e4-46.dat upx behavioral1/memory/1384-54-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-142-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-143-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-145-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-147-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-149-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/272-152-0x0000000000D90000-0x0000000000F8A000-memory.dmp upx behavioral1/memory/272-153-0x0000000000D90000-0x0000000000F8A000-memory.dmp upx behavioral1/memory/1384-163-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-167-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-188-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-197-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-199-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-201-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/2192-203-0x0000000000080000-0x000000000027A000-memory.dmp upx behavioral1/memory/2192-204-0x0000000000080000-0x000000000027A000-memory.dmp upx behavioral1/memory/1384-206-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-208-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx behavioral1/memory/1384-210-0x0000000000C00000-0x0000000000DFA000-memory.dmp upx -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76f2a8.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF3B2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF3E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76f2ab.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76f2a8.msi msiexec.exe File created C:\Windows\Installer\f76f2ab.ipi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 2712 MSIF3E2.tmp 2992 Synaptics.exe 1384 ._cache_Synaptics.exe 272 XVZBZS.exe 2192 XVZBZS.exe -
Loads dropped DLL 5 IoCs
pid Process 2712 MSIF3E2.tmp 2712 MSIF3E2.tmp 2992 Synaptics.exe 2992 Synaptics.exe 1384 ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2372 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVZBZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIF3E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVZBZS.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1136 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1092 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2328 msiexec.exe 2328 msiexec.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe 1384 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1384 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 2372 msiexec.exe Token: SeIncreaseQuotaPrivilege 2372 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeSecurityPrivilege 2328 msiexec.exe Token: SeCreateTokenPrivilege 2372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2372 msiexec.exe Token: SeLockMemoryPrivilege 2372 msiexec.exe Token: SeIncreaseQuotaPrivilege 2372 msiexec.exe Token: SeMachineAccountPrivilege 2372 msiexec.exe Token: SeTcbPrivilege 2372 msiexec.exe Token: SeSecurityPrivilege 2372 msiexec.exe Token: SeTakeOwnershipPrivilege 2372 msiexec.exe Token: SeLoadDriverPrivilege 2372 msiexec.exe Token: SeSystemProfilePrivilege 2372 msiexec.exe Token: SeSystemtimePrivilege 2372 msiexec.exe Token: SeProfSingleProcessPrivilege 2372 msiexec.exe Token: SeIncBasePriorityPrivilege 2372 msiexec.exe Token: SeCreatePagefilePrivilege 2372 msiexec.exe Token: SeCreatePermanentPrivilege 2372 msiexec.exe Token: SeBackupPrivilege 2372 msiexec.exe Token: SeRestorePrivilege 2372 msiexec.exe Token: SeShutdownPrivilege 2372 msiexec.exe Token: SeDebugPrivilege 2372 msiexec.exe Token: SeAuditPrivilege 2372 msiexec.exe Token: SeSystemEnvironmentPrivilege 2372 msiexec.exe Token: SeChangeNotifyPrivilege 2372 msiexec.exe Token: SeRemoteShutdownPrivilege 2372 msiexec.exe Token: SeUndockPrivilege 2372 msiexec.exe Token: SeSyncAgentPrivilege 2372 msiexec.exe Token: SeEnableDelegationPrivilege 2372 msiexec.exe Token: SeManageVolumePrivilege 2372 msiexec.exe Token: SeImpersonatePrivilege 2372 msiexec.exe Token: SeCreateGlobalPrivilege 2372 msiexec.exe Token: SeBackupPrivilege 348 vssvc.exe Token: SeRestorePrivilege 348 vssvc.exe Token: SeAuditPrivilege 348 vssvc.exe Token: SeBackupPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeLoadDriverPrivilege 2912 DrvInst.exe Token: SeLoadDriverPrivilege 2912 DrvInst.exe Token: SeLoadDriverPrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2372 msiexec.exe 2372 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1092 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2712 2328 msiexec.exe 35 PID 2328 wrote to memory of 2712 2328 msiexec.exe 35 PID 2328 wrote to memory of 2712 2328 msiexec.exe 35 PID 2328 wrote to memory of 2712 2328 msiexec.exe 35 PID 2712 wrote to memory of 2992 2712 MSIF3E2.tmp 36 PID 2712 wrote to memory of 2992 2712 MSIF3E2.tmp 36 PID 2712 wrote to memory of 2992 2712 MSIF3E2.tmp 36 PID 2712 wrote to memory of 2992 2712 MSIF3E2.tmp 36 PID 2992 wrote to memory of 1384 2992 Synaptics.exe 37 PID 2992 wrote to memory of 1384 2992 Synaptics.exe 37 PID 2992 wrote to memory of 1384 2992 Synaptics.exe 37 PID 2992 wrote to memory of 1384 2992 Synaptics.exe 37 PID 1384 wrote to memory of 1904 1384 ._cache_Synaptics.exe 39 PID 1384 wrote to memory of 1904 1384 ._cache_Synaptics.exe 39 PID 1384 wrote to memory of 1904 1384 ._cache_Synaptics.exe 39 PID 1384 wrote to memory of 1904 1384 ._cache_Synaptics.exe 39 PID 1384 wrote to memory of 1692 1384 ._cache_Synaptics.exe 41 PID 1384 wrote to memory of 1692 1384 ._cache_Synaptics.exe 41 PID 1384 wrote to memory of 1692 1384 ._cache_Synaptics.exe 41 PID 1384 wrote to memory of 1692 1384 ._cache_Synaptics.exe 41 PID 1904 wrote to memory of 1136 1904 cmd.exe 42 PID 1904 wrote to memory of 1136 1904 cmd.exe 42 PID 1904 wrote to memory of 1136 1904 cmd.exe 42 PID 1904 wrote to memory of 1136 1904 cmd.exe 42 PID 784 wrote to memory of 272 784 taskeng.exe 47 PID 784 wrote to memory of 272 784 taskeng.exe 47 PID 784 wrote to memory of 272 784 taskeng.exe 47 PID 784 wrote to memory of 272 784 taskeng.exe 47 PID 784 wrote to memory of 2192 784 taskeng.exe 49 PID 784 wrote to memory of 2192 784 taskeng.exe 49 PID 784 wrote to memory of 2192 784 taskeng.exe 49 PID 784 wrote to memory of 2192 784 taskeng.exe 49 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\docx.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2372
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\Installer\MSIF3E2.tmp"C:\Windows\Installer\MSIF3E2.tmp"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn TGWEKK.exe /tr C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn TGWEKK.exe /tr C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1136
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\TGWEKK.vbs5⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:348
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B4" "00000000000003D8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1092
-
C:\Windows\system32\taskeng.exetaskeng.exe {8784CB23-8DBD-40D1-8E9F-DB6CC80F9F07} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exeC:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:272
-
-
C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exeC:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
621B
MD50c545aa6b01773ca3a644fd1afd33837
SHA1ab07418d7403a246a66e1f399781a827a6e99c9a
SHA2565594f53643ab48a2d5ec5f11d53008425e1ca8f4e9bb81260434be9f5f7741b4
SHA512b4899aaa3ecaf9238cea0d230df748e3506027cdc11c23536b445a234f18fab085430e2b7ee7a29eff5b2562e73f31bb6caee77dc4fb7b260224f35833d6132b
-
Filesize
21KB
MD5fa241b01e8f58d681efd2de44e703c0d
SHA17c0c239d17da577ffc6788dfb762cc6d21d4b05d
SHA256a21b7cd44f57a56aed8d559cb9203f6dc8f9cee4f4e9218cd7634a5a91a6f212
SHA512d8cbf2063ec04d6bac753f34d93a4cb68a223ddb1209cd85e70202dc3c898eda94b46de4a5dafb76a1c1a97ec19b42548aa57fd357b03c9556815b2a781f2d89
-
Filesize
25KB
MD51022f969868eb2b596548454a60c9fb4
SHA1132245ef88dc34fcd834df52a4563380c02ca548
SHA256dcc1e9ca8591a35fb812f9c52bd3bb819aa86d7cb328c895ac4b4486460f75a6
SHA5127b61a07441e7e2febb89c172e334edb98df9cfcd33f525935bb20bbd5a85988426c775640b994a874c7b060b7db23e0b3d932aee0c9b6fd00049a206a2e43f4e
-
Filesize
25KB
MD57183da973a2cc8bb9ceda309c64e054f
SHA185b14ec3fd276edbedc773a60e8cbdfbdfc4e37b
SHA256efd8487459890f62ef29ad2a08415490f2c307a5e7702f1c14cfc2a9b2d89414
SHA51261b158d4e83c509f0f8a657e9859e031345fcad75faffe9ad92041310102bf1ca79353bace66e56c9af7fe6d2029e42d39cc93e8ef1ca807a30064dc81f1c130
-
Filesize
27KB
MD536fc6729d4cf5bf491acc4821a4781b7
SHA1d0ff93fd01a17b412541072ca06d61409b0d4db0
SHA25671f7137bd11b33b2ac5cbb8d4d9e2b586c965e135a57f2f40c879ec3b9ecf3aa
SHA5122ebab41b3b357edd07a6c23e3e91fdfbb477452cb4b79d237f07c36df4f6097c49b2ad5fdbb7446d165c9e24acbe68adb40f8cba8fd5b07bfd4f3ab6f2ccfa76
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
1.6MB
MD5a0177c0a9f2254179b112eecf3c58cc6
SHA103478f572f818c8ffd7f8ebe23632432e82e4461
SHA25655d2bea108eeaabcdf59d449cf15f0efabb59e243d9bd91ff0b0805cd3d133df
SHA5120247f803d5018659899766fe8758c14081b1fe9f414c2afb8f34e78569bf5e9063b746c3adf388b60017367070582e7d8b9422ae94bcef4c8c0d39fa7e4a4470
-
Filesize
917KB
MD514ae5a17618d08f48a350e9496c2c959
SHA1678bea5c7d0bb18d0dcab46c646536de5a51d24f
SHA25636dac4b76a8c3ea977d141ee3df142383efa9b0bc24d19da949d106d0b602207
SHA512fca819082bd9479a7d8bcf27203f4a832e6148dc44655463a28490ca3c3f39f5d1d5ae57f6c235a03fca136b6e315338e776040d1ad18eb200d3953e73d464c2