Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
valyzt.msi
Resource
win7-20240903-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
valyzt.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
valyzt.msi
-
Size
1.7MB
-
MD5
53614b87538306b4f7437db8be2a0e47
-
SHA1
a6a777b24bb64067738386caa66787b8ed225726
-
SHA256
e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8
-
SHA512
cfed71c6b9eb55b3ebfb53cbdb1611e8921a6dbe7b7efc5456cebb9bfb3d6a64f23a97c63415d61c38c4e3b540a79fd50cb2a080220bf3ea32edc98f85e6ecc1
-
SSDEEP
49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBMQLS.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBMQLS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EWZJGF.exe\"" ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIB6FD.tmp -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2232-216-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-215-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-223-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/3628-228-0x00000000005D0000-0x00000000007D0000-memory.dmp autoit_exe behavioral2/memory/2232-230-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-235-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-238-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-262-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-264-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2888-267-0x00000000005D0000-0x00000000007D0000-memory.dmp autoit_exe behavioral2/memory/2232-268-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-270-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-272-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-274-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe behavioral2/memory/2232-276-0x0000000000ED0000-0x00000000010D0000-memory.dmp autoit_exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation MSIB6FD.tmp Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\._cache_MSIB6FD.tmp MSIB6FD.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe File created C:\Windows\SysWOW64\._cache_MSIB6FD.tmp MSIB6FD.tmp -
resource yara_rule behavioral2/files/0x000d000000023b79-96.dat upx behavioral2/memory/2232-153-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-216-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-215-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-223-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/3628-225-0x00000000005D0000-0x00000000007D0000-memory.dmp upx behavioral2/memory/3628-228-0x00000000005D0000-0x00000000007D0000-memory.dmp upx behavioral2/memory/2232-230-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-235-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-238-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-262-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-264-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2888-267-0x00000000005D0000-0x00000000007D0000-memory.dmp upx behavioral2/memory/2232-268-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-270-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-272-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-274-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx behavioral2/memory/2232-276-0x0000000000ED0000-0x00000000010D0000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSIB68E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6FD.tmp msiexec.exe File created C:\Windows\Installer\e57b5d3.msi msiexec.exe File opened for modification C:\Windows\Installer\e57b5d3.msi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 1020 MSIB6FD.tmp 3064 Synaptics.exe 2232 ._cache_Synaptics.exe 3628 EWZJGF.exe 2888 EWZJGF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4272 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIB6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a47b29fbd6f9c3720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a47b29fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a47b29fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da47b29fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a47b29fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MSIB6FD.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3868 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4848 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 640 msiexec.exe 640 msiexec.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe 2232 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2232 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 640 msiexec.exe Token: SeCreateTokenPrivilege 4272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4272 msiexec.exe Token: SeLockMemoryPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeMachineAccountPrivilege 4272 msiexec.exe Token: SeTcbPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 4272 msiexec.exe Token: SeTakeOwnershipPrivilege 4272 msiexec.exe Token: SeLoadDriverPrivilege 4272 msiexec.exe Token: SeSystemProfilePrivilege 4272 msiexec.exe Token: SeSystemtimePrivilege 4272 msiexec.exe Token: SeProfSingleProcessPrivilege 4272 msiexec.exe Token: SeIncBasePriorityPrivilege 4272 msiexec.exe Token: SeCreatePagefilePrivilege 4272 msiexec.exe Token: SeCreatePermanentPrivilege 4272 msiexec.exe Token: SeBackupPrivilege 4272 msiexec.exe Token: SeRestorePrivilege 4272 msiexec.exe Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeDebugPrivilege 4272 msiexec.exe Token: SeAuditPrivilege 4272 msiexec.exe Token: SeSystemEnvironmentPrivilege 4272 msiexec.exe Token: SeChangeNotifyPrivilege 4272 msiexec.exe Token: SeRemoteShutdownPrivilege 4272 msiexec.exe Token: SeUndockPrivilege 4272 msiexec.exe Token: SeSyncAgentPrivilege 4272 msiexec.exe Token: SeEnableDelegationPrivilege 4272 msiexec.exe Token: SeManageVolumePrivilege 4272 msiexec.exe Token: SeImpersonatePrivilege 4272 msiexec.exe Token: SeCreateGlobalPrivilege 4272 msiexec.exe Token: SeBackupPrivilege 3068 vssvc.exe Token: SeRestorePrivilege 3068 vssvc.exe Token: SeAuditPrivilege 3068 vssvc.exe Token: SeBackupPrivilege 640 msiexec.exe Token: SeRestorePrivilege 640 msiexec.exe Token: SeRestorePrivilege 640 msiexec.exe Token: SeTakeOwnershipPrivilege 640 msiexec.exe Token: SeRestorePrivilege 640 msiexec.exe Token: SeTakeOwnershipPrivilege 640 msiexec.exe Token: SeRestorePrivilege 640 msiexec.exe Token: SeTakeOwnershipPrivilege 640 msiexec.exe Token: SeBackupPrivilege 2888 srtasks.exe Token: SeRestorePrivilege 2888 srtasks.exe Token: SeSecurityPrivilege 2888 srtasks.exe Token: SeTakeOwnershipPrivilege 2888 srtasks.exe Token: SeBackupPrivilege 2888 srtasks.exe Token: SeRestorePrivilege 2888 srtasks.exe Token: SeSecurityPrivilege 2888 srtasks.exe Token: SeTakeOwnershipPrivilege 2888 srtasks.exe Token: SeRestorePrivilege 640 msiexec.exe Token: SeTakeOwnershipPrivilege 640 msiexec.exe Token: SeRestorePrivilege 640 msiexec.exe Token: SeTakeOwnershipPrivilege 640 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4272 msiexec.exe 4272 msiexec.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 640 wrote to memory of 2888 640 msiexec.exe 92 PID 640 wrote to memory of 2888 640 msiexec.exe 92 PID 640 wrote to memory of 1020 640 msiexec.exe 97 PID 640 wrote to memory of 1020 640 msiexec.exe 97 PID 640 wrote to memory of 1020 640 msiexec.exe 97 PID 1020 wrote to memory of 3064 1020 MSIB6FD.tmp 98 PID 1020 wrote to memory of 3064 1020 MSIB6FD.tmp 98 PID 1020 wrote to memory of 3064 1020 MSIB6FD.tmp 98 PID 3064 wrote to memory of 2232 3064 Synaptics.exe 99 PID 3064 wrote to memory of 2232 3064 Synaptics.exe 99 PID 3064 wrote to memory of 2232 3064 Synaptics.exe 99 PID 2232 wrote to memory of 1488 2232 ._cache_Synaptics.exe 103 PID 2232 wrote to memory of 1488 2232 ._cache_Synaptics.exe 103 PID 2232 wrote to memory of 1488 2232 ._cache_Synaptics.exe 103 PID 2232 wrote to memory of 4420 2232 ._cache_Synaptics.exe 105 PID 2232 wrote to memory of 4420 2232 ._cache_Synaptics.exe 105 PID 2232 wrote to memory of 4420 2232 ._cache_Synaptics.exe 105 PID 1488 wrote to memory of 3868 1488 cmd.exe 106 PID 1488 wrote to memory of 3868 1488 cmd.exe 106 PID 1488 wrote to memory of 3868 1488 cmd.exe 106 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\valyzt.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4272
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\Installer\MSIB6FD.tmp"C:\Windows\Installer\MSIB6FD.tmp"2⤵
- Adds Run key to start application
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3868
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs5⤵
- System Location Discovery: System Language Discovery
PID:4420
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4848
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3628
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
623B
MD576839dcde87f7213ca06ca590df2907a
SHA161a5239feb50aa07988b13963c077001d764a2cd
SHA256b0c97db66441eb34b30c9b00c55d7d10d03381d12007eecba7cf07c76fd3814a
SHA512d796018817f02cd95e14fbe3e14f39416b57e621d71dd73d517deba2a141550b59bc2314439b5535b715ef523bcdd9d7af0ccc6e8eb5cea71df2fcb1846cab3f
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD51b8ceabeb10594a23b0e52bb0b8017b9
SHA1930af4b30961cf50bd80e5d64ae9397073e33a47
SHA256bfb237e0aa7a09817f50e24477f338f1c6330e1f5f49234213c85cd3800895de
SHA512f749ca4d3c4e3755176e6a26a28bb1e43a2ea7ba6940aba2976a8250bf98a59f3f5b0cb19fe9bd64a7cfcc6afe24fb5813a34b551f8c9624a0ed6750cef9b4af
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
1.6MB
MD571386f37f17778126296ca734975db6d
SHA1353818dcd74d06565fc0e8ac4416e594d29ecd0b
SHA256c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae
SHA512e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c
-
Filesize
930KB
MD536f4c5372c6391f782c2db490081746f
SHA1a0b1ec84b0a2db8f801981e247578217b71b38da
SHA2561fe023f69f42fcd4be4baa180bbff00b7ffe51c553211dd0df45fb7ff71148b8
SHA512111c1915d81141398b6bb7a0aa0e98896fb05d5548ace8fd1e0e23343eae60ea1e3d6617d3f5f883b96c8e05f5f868a280683341810896c00fa6ef1f68338992
-
Filesize
24.1MB
MD5a06b03f9bf3d22ea2f06bcfc841fb6d0
SHA1b83d5a21697438b7287cf5fecd2cb1655e52d36c
SHA2565e3fd7d6c69f7019571b3e1a0f18274dcf5a0df3f2e8cee90a7c39fc3c6183f9
SHA5128452f1d1b5a1007bce2ea151441909a6fcaf26d155c5c20806a856d5b04f6dff93e30ba1bd7dbc6f568f15f1961eb41ac94c44b6691a4cb94d1466f80ed74895
-
\??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{dd7dc004-2a4a-4adf-b6c7-32d66f11cac7}_OnDiskSnapshotProp
Filesize6KB
MD56efee53892be0a56c677a10c7e976c50
SHA12b4634560211515572ac3ecd703fcc51101d99ac
SHA2565a462a79b8322a2bd2c5aef7c6d5de230e4e3ba70a82296e947e4bcfcc6375ef
SHA51218bec997881e9cd17c9a5b19b8dfb1d8ff3e47ae70cb71e13bb95df30f48ca92f6cf12c9dce71dafb223337aeda61c54c7d8972bf97bcd6df76056e741aaf7bd