Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 10:28
Static task
static1
Behavioral task
behavioral1
Sample
xyxmml.msi
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
xyxmml.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
xyxmml.msi
-
Size
1.7MB
-
MD5
51dd5767de678bb6359cbb175319f0ec
-
SHA1
76ae487dda6cf3651a9b2b30614c0fefd1f3149c
-
SHA256
5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314
-
SHA512
ffb798290e2f6840eb8f0587dc675e8654589bfd070b1c54e49c7984272aa94da3a493cbd28b1dddef1f6a44b09ad9fd8a14ec0d77b90f948dc85089f91cc8a0
-
SSDEEP
49152:+EJnsHyjtk2MYC5GDChloJfWJ255hpB14Rd:1nsmtk2arhlTJ23h
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRIYKG.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSICF86.tmp Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MRIYKG = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\CHVALO.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3596-217-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-216-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-222-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-224-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/2612-228-0x0000000000590000-0x0000000000794000-memory.dmp autoit_exe behavioral2/memory/3596-230-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-235-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-239-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-260-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-264-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-266-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/1924-268-0x0000000000590000-0x0000000000794000-memory.dmp autoit_exe behavioral2/memory/3596-270-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-272-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-274-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe behavioral2/memory/3596-276-0x0000000000240000-0x0000000000444000-memory.dmp autoit_exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation MSICF86.tmp -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\._cache_MSICF86.tmp MSICF86.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe File created C:\Windows\SysWOW64\._cache_MSICF86.tmp MSICF86.tmp -
resource yara_rule behavioral2/files/0x000b000000023cac-94.dat upx behavioral2/memory/3596-152-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-217-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-216-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-222-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-224-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/2612-226-0x0000000000590000-0x0000000000794000-memory.dmp upx behavioral2/memory/2612-228-0x0000000000590000-0x0000000000794000-memory.dmp upx behavioral2/memory/3596-230-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-235-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-239-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-260-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-264-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-266-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/1924-268-0x0000000000590000-0x0000000000794000-memory.dmp upx behavioral2/memory/3596-270-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-272-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-274-0x0000000000240000-0x0000000000444000-memory.dmp upx behavioral2/memory/3596-276-0x0000000000240000-0x0000000000444000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSICF46.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICF86.tmp msiexec.exe File created C:\Windows\Installer\e57ce8b.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ce8b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 1748 MSICF86.tmp 4164 Synaptics.exe 3596 ._cache_Synaptics.exe 2612 CHVALO.exe 1924 CHVALO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2304 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHVALO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHVALO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSICF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MSICF86.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5024 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4316 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3876 msiexec.exe 3876 msiexec.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe 3596 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3596 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 2304 msiexec.exe Token: SeIncreaseQuotaPrivilege 2304 msiexec.exe Token: SeSecurityPrivilege 3876 msiexec.exe Token: SeCreateTokenPrivilege 2304 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2304 msiexec.exe Token: SeLockMemoryPrivilege 2304 msiexec.exe Token: SeIncreaseQuotaPrivilege 2304 msiexec.exe Token: SeMachineAccountPrivilege 2304 msiexec.exe Token: SeTcbPrivilege 2304 msiexec.exe Token: SeSecurityPrivilege 2304 msiexec.exe Token: SeTakeOwnershipPrivilege 2304 msiexec.exe Token: SeLoadDriverPrivilege 2304 msiexec.exe Token: SeSystemProfilePrivilege 2304 msiexec.exe Token: SeSystemtimePrivilege 2304 msiexec.exe Token: SeProfSingleProcessPrivilege 2304 msiexec.exe Token: SeIncBasePriorityPrivilege 2304 msiexec.exe Token: SeCreatePagefilePrivilege 2304 msiexec.exe Token: SeCreatePermanentPrivilege 2304 msiexec.exe Token: SeBackupPrivilege 2304 msiexec.exe Token: SeRestorePrivilege 2304 msiexec.exe Token: SeShutdownPrivilege 2304 msiexec.exe Token: SeDebugPrivilege 2304 msiexec.exe Token: SeAuditPrivilege 2304 msiexec.exe Token: SeSystemEnvironmentPrivilege 2304 msiexec.exe Token: SeChangeNotifyPrivilege 2304 msiexec.exe Token: SeRemoteShutdownPrivilege 2304 msiexec.exe Token: SeUndockPrivilege 2304 msiexec.exe Token: SeSyncAgentPrivilege 2304 msiexec.exe Token: SeEnableDelegationPrivilege 2304 msiexec.exe Token: SeManageVolumePrivilege 2304 msiexec.exe Token: SeImpersonatePrivilege 2304 msiexec.exe Token: SeCreateGlobalPrivilege 2304 msiexec.exe Token: SeBackupPrivilege 4840 vssvc.exe Token: SeRestorePrivilege 4840 vssvc.exe Token: SeAuditPrivilege 4840 vssvc.exe Token: SeBackupPrivilege 3876 msiexec.exe Token: SeRestorePrivilege 3876 msiexec.exe Token: SeRestorePrivilege 3876 msiexec.exe Token: SeTakeOwnershipPrivilege 3876 msiexec.exe Token: SeRestorePrivilege 3876 msiexec.exe Token: SeTakeOwnershipPrivilege 3876 msiexec.exe Token: SeRestorePrivilege 3876 msiexec.exe Token: SeTakeOwnershipPrivilege 3876 msiexec.exe Token: SeRestorePrivilege 3876 msiexec.exe Token: SeTakeOwnershipPrivilege 3876 msiexec.exe Token: SeRestorePrivilege 3876 msiexec.exe Token: SeTakeOwnershipPrivilege 3876 msiexec.exe Token: SeBackupPrivilege 4364 srtasks.exe Token: SeRestorePrivilege 4364 srtasks.exe Token: SeSecurityPrivilege 4364 srtasks.exe Token: SeTakeOwnershipPrivilege 4364 srtasks.exe Token: SeBackupPrivilege 4364 srtasks.exe Token: SeRestorePrivilege 4364 srtasks.exe Token: SeSecurityPrivilege 4364 srtasks.exe Token: SeTakeOwnershipPrivilege 4364 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2304 msiexec.exe 2304 msiexec.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE 4316 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3876 wrote to memory of 4364 3876 msiexec.exe 92 PID 3876 wrote to memory of 4364 3876 msiexec.exe 92 PID 3876 wrote to memory of 1748 3876 msiexec.exe 94 PID 3876 wrote to memory of 1748 3876 msiexec.exe 94 PID 3876 wrote to memory of 1748 3876 msiexec.exe 94 PID 1748 wrote to memory of 4164 1748 MSICF86.tmp 95 PID 1748 wrote to memory of 4164 1748 MSICF86.tmp 95 PID 1748 wrote to memory of 4164 1748 MSICF86.tmp 95 PID 4164 wrote to memory of 3596 4164 Synaptics.exe 96 PID 4164 wrote to memory of 3596 4164 Synaptics.exe 96 PID 4164 wrote to memory of 3596 4164 Synaptics.exe 96 PID 3596 wrote to memory of 5064 3596 ._cache_Synaptics.exe 97 PID 3596 wrote to memory of 5064 3596 ._cache_Synaptics.exe 97 PID 3596 wrote to memory of 5064 3596 ._cache_Synaptics.exe 97 PID 3596 wrote to memory of 3168 3596 ._cache_Synaptics.exe 99 PID 3596 wrote to memory of 3168 3596 ._cache_Synaptics.exe 99 PID 3596 wrote to memory of 3168 3596 ._cache_Synaptics.exe 99 PID 5064 wrote to memory of 5024 5064 cmd.exe 100 PID 5064 wrote to memory of 5024 5064 cmd.exe 100 PID 5064 wrote to memory of 5024 5064 cmd.exe 100 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\xyxmml.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2304
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\Installer\MSICF86.tmp"C:\Windows\Installer\MSICF86.tmp"2⤵
- Adds Run key to start application
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn MRIYKG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn MRIYKG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5024
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\MRIYKG.vbs5⤵
- System Location Discovery: System Language Discovery
PID:3168
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4316
-
C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exeC:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exeC:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
623B
MD55c456ba15ea928aa777acd11bd3b7e10
SHA1028220c7e9f5b0b4d05f0887caec6582af63c0b9
SHA2564994014aaa86fb580dcc46396ac16902dedd3aad91059e0efd64833e4643c862
SHA51289bcb67e3e42d4974d0b8ec70d37e897b6b3fecadc02f6fe7d8bc4e7c90c641348c18435a219be18acc913a0c65998c8130bac8747837e4e7cff3882497dccae
-
Filesize
22KB
MD58b7740b12b85c5fbdcc6e3dfe14ea665
SHA1746ff68c47d6f43215d024917e8de5e021bc657e
SHA256509bf1bd56ed591ffca858907dc369abebe0446c5bcd8b0b7d699877e603edbe
SHA51211bb8a954b5e73efab2c289ac5aa8c93c0d4ce7aaa1b7ade3e5c650dcecfdf49ace3f0b27c78727a2b395dd54ea9d1fecb9d364e3fc0e698299ae41dada41d62
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
1.6MB
MD51d2237faf8e6198625010cb580280901
SHA1592449bddf763bb63c22f638cb42f71484f87f06
SHA25678643b903379276085c5ef0092afc5c10dee821c5754e01bc8ef835907b16ac4
SHA5128abe1ff967d92c663080caf54f315e534ea296c91474d66cd327dccc38a3aa8685101649bb120e28f1438011596dde4f2f83e8150c90d51529efce9906a5aa0b
-
Filesize
935KB
MD5a1d37a2a0a4cd5038e129946ee935868
SHA187042fbecf1558a2e974c6ad045584f23e1ac7c9
SHA2569988b0297ad8be4bd3c559437176eaca54cdc36593728967395c4dee21fc898c
SHA512eb6cfcc7b1c526c06737dc6187af4f65bdd178ffc951cf8bb13571b44cc2c3c0cd051c6e9b4930433f8e6830420a04e0b538d353dd86a1fefb0663032c37c03c
-
Filesize
24.1MB
MD5e9c54f1be6565b2fd4369f05e1e9203e
SHA19b216e8ac83a0ff746bcac7a818c2025e996638b
SHA256f0dd3bbe8e41aa81064418e8c59d9b125c38a43d95f5a1c9369fbcdd8bf68608
SHA512f1e32583a1b5b96d61c2544dbbb9aa56b469ea72e9bfc7d6c7906ddfbc64ad81f77d888c2023e4eeee2c9922808f73fb9a6292ea75205c1dba8ef77e2085e420
-
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aae5e8c9-e621-4caa-ab1b-27f1908a1799}_OnDiskSnapshotProp
Filesize6KB
MD587361c84655642355838d53a27af410f
SHA15fd102769f11e07acb72bc9c6463dd43a8dec53b
SHA256ed414d8e3a82af8128ee952b7625a2f58b3bafb6bab8a4a2411543fc55147759
SHA51215d31d304f4b0b125b50b29d73d6693f776996329287c557e7625f8dd7b6ede20cfb8713c2120857269a5f79f4bc6b429ab9be36a875bc39705feb57f681f39d