xred | fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

docx.msi
Size

1.7MB
MD5

904ac94be4b6b3e1a4bf741d80401879
SHA1

bfd7f9e4bb42f54c02c4933439c9e90b8c975299
SHA256

fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648
SHA512

c2ff2e02c00e485e3551c6a8b3451cf227f8317e4b908b4fe1202337288937cebffbdbd2f5bc5ae33326ef9e14e9f8c18563bdfe3d6d5c9dad7413b96fbd31e9
SSDEEP

49152:PEVnsHyjtk2MYC5GDFhloJfjQiCSAKyHI9K9:mnsmtk2aAhl0RC1g

Score

10^/10

xred backdoor discovery persistence privilege_escalation upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TGWEKK.lnk	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	MSIDFD6.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\TGWEKK = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\XVZBZS.exe\""	._cache_Synaptics.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1628-108-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-110-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-113-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1484-118-0x0000000000D80000-0x0000000000F7A000-memory.dmp	autoit_exe
behavioral1/memory/1628-120-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-122-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-124-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-140-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-168-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1700-171-0x0000000001210000-0x000000000140A000-memory.dmp	autoit_exe
behavioral1/memory/1628-173-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-175-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-177-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-179-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-181-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1628-183-0x00000000003B0000-0x00000000005AA000-memory.dmp	autoit_exe
behavioral1/memory/1124-185-0x0000000001210000-0x000000000140A000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\._cache_MSIDFD6.tmp	MSIDFD6.tmp
File opened for modification	C:\Windows\SysWOW64\._cache_MSIDFD6.tmp	MSIDFD6.tmp
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2	._cache_Synaptics.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000016d2e-44.dat	upx
behavioral1/memory/1628-54-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/860-51-0x00000000057B0000-0x00000000059AA000-memory.dmp	upx
behavioral1/memory/1628-108-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-110-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-113-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1484-116-0x0000000000D80000-0x0000000000F7A000-memory.dmp	upx
behavioral1/memory/1484-118-0x0000000000D80000-0x0000000000F7A000-memory.dmp	upx
behavioral1/memory/1628-120-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-122-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-124-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-140-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-168-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1700-170-0x0000000001210000-0x000000000140A000-memory.dmp	upx
behavioral1/memory/1700-171-0x0000000001210000-0x000000000140A000-memory.dmp	upx
behavioral1/memory/1628-173-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-175-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-177-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-179-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-181-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1628-183-0x00000000003B0000-0x00000000005AA000-memory.dmp	upx
behavioral1/memory/1124-185-0x0000000001210000-0x000000000140A000-memory.dmp	upx

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76de7d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76de7d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76de80.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFD6.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76de80.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF76.tmp	msiexec.exe

Executes dropped EXE 6 IoCs

pid	Process
2648	MSIDFD6.tmp
860	Synaptics.exe
1628	._cache_Synaptics.exe
1484	XVZBZS.exe
1700	XVZBZS.exe
1124	XVZBZS.exe

Loads dropped DLL 5 IoCs

pid	Process
2648	MSIDFD6.tmp
2648	MSIDFD6.tmp
860	Synaptics.exe
860	Synaptics.exe
1628	._cache_Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3008	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIDFD6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XVZBZS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XVZBZS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XVZBZS.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2192	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1128	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
332	msiexec.exe
332	msiexec.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe
1628	._cache_Synaptics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1628	._cache_Synaptics.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3008	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeSecurityPrivilege	332	msiexec.exe
Token: SeCreateTokenPrivilege	3008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3008	msiexec.exe
Token: SeLockMemoryPrivilege	3008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3008	msiexec.exe
Token: SeMachineAccountPrivilege	3008	msiexec.exe
Token: SeTcbPrivilege	3008	msiexec.exe
Token: SeSecurityPrivilege	3008	msiexec.exe
Token: SeTakeOwnershipPrivilege	3008	msiexec.exe
Token: SeLoadDriverPrivilege	3008	msiexec.exe
Token: SeSystemProfilePrivilege	3008	msiexec.exe
Token: SeSystemtimePrivilege	3008	msiexec.exe
Token: SeProfSingleProcessPrivilege	3008	msiexec.exe
Token: SeIncBasePriorityPrivilege	3008	msiexec.exe
Token: SeCreatePagefilePrivilege	3008	msiexec.exe
Token: SeCreatePermanentPrivilege	3008	msiexec.exe
Token: SeBackupPrivilege	3008	msiexec.exe
Token: SeRestorePrivilege	3008	msiexec.exe
Token: SeShutdownPrivilege	3008	msiexec.exe
Token: SeDebugPrivilege	3008	msiexec.exe
Token: SeAuditPrivilege	3008	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3008	msiexec.exe
Token: SeChangeNotifyPrivilege	3008	msiexec.exe
Token: SeRemoteShutdownPrivilege	3008	msiexec.exe
Token: SeUndockPrivilege	3008	msiexec.exe
Token: SeSyncAgentPrivilege	3008	msiexec.exe
Token: SeEnableDelegationPrivilege	3008	msiexec.exe
Token: SeManageVolumePrivilege	3008	msiexec.exe
Token: SeImpersonatePrivilege	3008	msiexec.exe
Token: SeCreateGlobalPrivilege	3008	msiexec.exe
Token: SeBackupPrivilege	2340	vssvc.exe
Token: SeRestorePrivilege	2340	vssvc.exe
Token: SeAuditPrivilege	2340	vssvc.exe
Token: SeBackupPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeLoadDriverPrivilege	2308	DrvInst.exe
Token: SeLoadDriverPrivilege	2308	DrvInst.exe
Token: SeLoadDriverPrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3008	msiexec.exe
3008	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	EXCEL.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2648	332	msiexec.exe	35
PID 332 wrote to memory of 2648	332	msiexec.exe	35
PID 332 wrote to memory of 2648	332	msiexec.exe	35
PID 332 wrote to memory of 2648	332	msiexec.exe	35
PID 2648 wrote to memory of 860	2648	MSIDFD6.tmp	36
PID 2648 wrote to memory of 860	2648	MSIDFD6.tmp	36
PID 2648 wrote to memory of 860	2648	MSIDFD6.tmp	36
PID 2648 wrote to memory of 860	2648	MSIDFD6.tmp	36
PID 860 wrote to memory of 1628	860	Synaptics.exe	37
PID 860 wrote to memory of 1628	860	Synaptics.exe	37
PID 860 wrote to memory of 1628	860	Synaptics.exe	37
PID 860 wrote to memory of 1628	860	Synaptics.exe	37
PID 1628 wrote to memory of 3064	1628	._cache_Synaptics.exe	38
PID 1628 wrote to memory of 3064	1628	._cache_Synaptics.exe	38
PID 1628 wrote to memory of 3064	1628	._cache_Synaptics.exe	38
PID 1628 wrote to memory of 3064	1628	._cache_Synaptics.exe	38
PID 1628 wrote to memory of 2208	1628	._cache_Synaptics.exe	40
PID 1628 wrote to memory of 2208	1628	._cache_Synaptics.exe	40
PID 1628 wrote to memory of 2208	1628	._cache_Synaptics.exe	40
PID 1628 wrote to memory of 2208	1628	._cache_Synaptics.exe	40
PID 3064 wrote to memory of 2192	3064	cmd.exe	41
PID 3064 wrote to memory of 2192	3064	cmd.exe	41
PID 3064 wrote to memory of 2192	3064	cmd.exe	41
PID 3064 wrote to memory of 2192	3064	cmd.exe	41
PID 2960 wrote to memory of 1484	2960	taskeng.exe	46
PID 2960 wrote to memory of 1484	2960	taskeng.exe	46
PID 2960 wrote to memory of 1484	2960	taskeng.exe	46
PID 2960 wrote to memory of 1484	2960	taskeng.exe	46
PID 2960 wrote to memory of 1700	2960	taskeng.exe	47
PID 2960 wrote to memory of 1700	2960	taskeng.exe	47
PID 2960 wrote to memory of 1700	2960	taskeng.exe	47
PID 2960 wrote to memory of 1700	2960	taskeng.exe	47
PID 2960 wrote to memory of 1124	2960	taskeng.exe	48
PID 2960 wrote to memory of 1124	2960	taskeng.exe	48
PID 2960 wrote to memory of 1124	2960	taskeng.exe	48
PID 2960 wrote to memory of 1124	2960	taskeng.exe	48

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\docx.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3008

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\Installer\MSIDFD6.tmp
  "C:\Windows\Installer\MSIDFD6.tmp"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Drops file in System32 directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe" InjUpdate
      4⤵
      Drops startup file
      Adds Run key to start application
      Drops file in System32 directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn TGWEKK.exe /tr C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe /sc minute /mo 1
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn TGWEKK.exe /tr C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe /sc minute /mo 1
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2192
    - - C:\Windows\SysWOW64\WSCript.exe
        
        WSCript C:\Users\Admin\AppData\Local\Temp\TGWEKK.vbs
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C4" "00000000000003BC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Windows\system32\taskeng.exe
taskeng.exe {0331BAB9-A59E-4CFB-9688-F84A74571047} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe
  C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1484
- C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe
  C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1700
- C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe
  C:\Users\Admin\AppData\Roaming\Windata\XVZBZS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76de81.rbs

Filesize
621B

MD5
bd48478043ab82fafd9a62a1883b6d2c

SHA1
a2ed6ed548c3d2ece3afeae28b1fe8eeccc17437

SHA256
3cde7e4184eab9de0c7d9c9971922d24c8f237b34d10a2da44020f46294a072c

SHA512
23f8acb0a51fe7ff4525c21f4fde7c7675347c12508ad390f1ddbd6ee3817a2fda24aaca52218f5edad5caf485086a9356e2c1acc537ca37ed959b4d50c4db43

Download Submit
C:\Users\Admin\AppData\Local\Temp\TGWEKK.vbs

Filesize
840B

MD5
89137407cd4107effa2ff9f29a2a99ad

SHA1
99814ebc80118160841a2cf0f29eb578b57e4ac6

SHA256
cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36

SHA512
d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dKYCpZq3.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\dKYCpZq3.xlsm

Filesize
24KB

MD5
15b4391e4ada5e98bb1cd3666b013a57

SHA1
8f974dc403af70be604e043717c53d8957fd6155

SHA256
e6763d91a21e394ec367839e0c237bc4b85197ee60c985930655d88bcc7744fa

SHA512
660baea60b7ea9e2fb1f41566057c234beb3633fc820d3f75da238b52af142e2bfe2674584824b202cd2fde0b54949523745036753c8b1beb8005a9e4afe8607

Download Submit
C:\Windows\Installer\MSIDFD6.tmp

Filesize
1.6MB

MD5
a0177c0a9f2254179b112eecf3c58cc6

SHA1
03478f572f818c8ffd7f8ebe23632432e82e4461

SHA256
55d2bea108eeaabcdf59d449cf15f0efabb59e243d9bd91ff0b0805cd3d133df

SHA512
0247f803d5018659899766fe8758c14081b1fe9f414c2afb8f34e78569bf5e9063b746c3adf388b60017367070582e7d8b9422ae94bcef4c8c0d39fa7e4a4470

Download Submit
C:\Windows\SysWOW64\._cache_Synaptics.exe

Filesize
917KB

MD5
14ae5a17618d08f48a350e9496c2c959

SHA1
678bea5c7d0bb18d0dcab46c646536de5a51d24f

SHA256
36dac4b76a8c3ea977d141ee3df142383efa9b0bc24d19da949d106d0b602207

SHA512
fca819082bd9479a7d8bcf27203f4a832e6148dc44655463a28490ca3c3f39f5d1d5ae57f6c235a03fca136b6e315338e776040d1ad18eb200d3953e73d464c2

Download Submit
memory/860-139-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/860-51-0x00000000057B0000-0x00000000059AA000-memory.dmp

Filesize
2.0MB

Download
memory/860-167-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/860-107-0x00000000057B0000-0x00000000059AA000-memory.dmp

Filesize
2.0MB

Download
memory/860-121-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/860-109-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/1124-185-0x0000000001210000-0x000000000140A000-memory.dmp

Filesize
2.0MB

Download
memory/1128-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1484-118-0x0000000000D80000-0x0000000000F7A000-memory.dmp

Filesize
2.0MB

Download
memory/1484-116-0x0000000000D80000-0x0000000000F7A000-memory.dmp

Filesize
2.0MB

Download
memory/1628-54-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-181-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-110-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-120-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-108-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-122-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-124-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-168-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-140-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-113-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-60-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/1628-183-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-111-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/1628-173-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-175-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-177-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1628-179-0x00000000003B0000-0x00000000005AA000-memory.dmp

Filesize
2.0MB

Download
memory/1700-171-0x0000000001210000-0x000000000140A000-memory.dmp

Filesize
2.0MB

Download
memory/1700-170-0x0000000001210000-0x000000000140A000-memory.dmp

Filesize
2.0MB

Download
memory/2648-33-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download