Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 10:31
Static task
static1
Behavioral task
behavioral1
Sample
valyzt.msi
Resource
win7-20241023-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
valyzt.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
valyzt.msi
-
Size
1.7MB
-
MD5
53614b87538306b4f7437db8be2a0e47
-
SHA1
a6a777b24bb64067738386caa66787b8ed225726
-
SHA256
e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8
-
SHA512
cfed71c6b9eb55b3ebfb53cbdb1611e8921a6dbe7b7efc5456cebb9bfb3d6a64f23a97c63415d61c38c4e3b540a79fd50cb2a080220bf3ea32edc98f85e6ecc1
-
SSDEEP
49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBMQLS.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIE68A.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBMQLS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EWZJGF.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2660-110-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-111-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-116-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-118-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/1872-123-0x0000000000AD0000-0x0000000000CD0000-memory.dmp autoit_exe behavioral1/memory/2660-134-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-137-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-166-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-168-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-170-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2232-176-0x00000000001A0000-0x00000000003A0000-memory.dmp autoit_exe behavioral1/memory/2660-178-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-180-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe behavioral1/memory/2660-182-0x00000000011E0000-0x00000000013E0000-memory.dmp autoit_exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_MSIE68A.tmp MSIE68A.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSIE68A.tmp MSIE68A.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe -
resource yara_rule behavioral1/memory/2660-54-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/files/0x000b0000000165c7-52.dat upx behavioral1/memory/2660-110-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-111-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-116-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-118-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/1872-121-0x0000000000AD0000-0x0000000000CD0000-memory.dmp upx behavioral1/memory/1872-123-0x0000000000AD0000-0x0000000000CD0000-memory.dmp upx behavioral1/memory/2660-134-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-137-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-166-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-168-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-170-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2232-174-0x00000000001A0000-0x00000000003A0000-memory.dmp upx behavioral1/memory/2232-176-0x00000000001A0000-0x00000000003A0000-memory.dmp upx behavioral1/memory/2660-178-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-180-0x00000000011E0000-0x00000000013E0000-memory.dmp upx behavioral1/memory/2660-182-0x00000000011E0000-0x00000000013E0000-memory.dmp upx -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76e560.msi msiexec.exe File created C:\Windows\Installer\f76e563.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE68A.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76e560.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE659.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76e563.ipi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 2324 MSIE68A.tmp 2064 Synaptics.exe 2660 ._cache_Synaptics.exe 1872 EWZJGF.exe 2232 EWZJGF.exe -
Loads dropped DLL 5 IoCs
pid Process 2324 MSIE68A.tmp 2324 MSIE68A.tmp 2064 Synaptics.exe 2064 Synaptics.exe 2660 ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2536 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIE68A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1404 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 660 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 msiexec.exe 1792 msiexec.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe 2660 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2660 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 2536 msiexec.exe Token: SeIncreaseQuotaPrivilege 2536 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeSecurityPrivilege 1792 msiexec.exe Token: SeCreateTokenPrivilege 2536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2536 msiexec.exe Token: SeLockMemoryPrivilege 2536 msiexec.exe Token: SeIncreaseQuotaPrivilege 2536 msiexec.exe Token: SeMachineAccountPrivilege 2536 msiexec.exe Token: SeTcbPrivilege 2536 msiexec.exe Token: SeSecurityPrivilege 2536 msiexec.exe Token: SeTakeOwnershipPrivilege 2536 msiexec.exe Token: SeLoadDriverPrivilege 2536 msiexec.exe Token: SeSystemProfilePrivilege 2536 msiexec.exe Token: SeSystemtimePrivilege 2536 msiexec.exe Token: SeProfSingleProcessPrivilege 2536 msiexec.exe Token: SeIncBasePriorityPrivilege 2536 msiexec.exe Token: SeCreatePagefilePrivilege 2536 msiexec.exe Token: SeCreatePermanentPrivilege 2536 msiexec.exe Token: SeBackupPrivilege 2536 msiexec.exe Token: SeRestorePrivilege 2536 msiexec.exe Token: SeShutdownPrivilege 2536 msiexec.exe Token: SeDebugPrivilege 2536 msiexec.exe Token: SeAuditPrivilege 2536 msiexec.exe Token: SeSystemEnvironmentPrivilege 2536 msiexec.exe Token: SeChangeNotifyPrivilege 2536 msiexec.exe Token: SeRemoteShutdownPrivilege 2536 msiexec.exe Token: SeUndockPrivilege 2536 msiexec.exe Token: SeSyncAgentPrivilege 2536 msiexec.exe Token: SeEnableDelegationPrivilege 2536 msiexec.exe Token: SeManageVolumePrivilege 2536 msiexec.exe Token: SeImpersonatePrivilege 2536 msiexec.exe Token: SeCreateGlobalPrivilege 2536 msiexec.exe Token: SeBackupPrivilege 2000 vssvc.exe Token: SeRestorePrivilege 2000 vssvc.exe Token: SeAuditPrivilege 2000 vssvc.exe Token: SeBackupPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 2716 DrvInst.exe Token: SeLoadDriverPrivilege 2716 DrvInst.exe Token: SeLoadDriverPrivilege 2716 DrvInst.exe Token: SeLoadDriverPrivilege 2716 DrvInst.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2536 msiexec.exe 2536 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 660 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2324 1792 msiexec.exe 35 PID 1792 wrote to memory of 2324 1792 msiexec.exe 35 PID 1792 wrote to memory of 2324 1792 msiexec.exe 35 PID 1792 wrote to memory of 2324 1792 msiexec.exe 35 PID 2324 wrote to memory of 2064 2324 MSIE68A.tmp 36 PID 2324 wrote to memory of 2064 2324 MSIE68A.tmp 36 PID 2324 wrote to memory of 2064 2324 MSIE68A.tmp 36 PID 2324 wrote to memory of 2064 2324 MSIE68A.tmp 36 PID 2064 wrote to memory of 2660 2064 Synaptics.exe 37 PID 2064 wrote to memory of 2660 2064 Synaptics.exe 37 PID 2064 wrote to memory of 2660 2064 Synaptics.exe 37 PID 2064 wrote to memory of 2660 2064 Synaptics.exe 37 PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe 38 PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe 38 PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe 38 PID 2660 wrote to memory of 2968 2660 ._cache_Synaptics.exe 38 PID 2660 wrote to memory of 2156 2660 ._cache_Synaptics.exe 40 PID 2660 wrote to memory of 2156 2660 ._cache_Synaptics.exe 40 PID 2660 wrote to memory of 2156 2660 ._cache_Synaptics.exe 40 PID 2660 wrote to memory of 2156 2660 ._cache_Synaptics.exe 40 PID 2968 wrote to memory of 1404 2968 cmd.exe 41 PID 2968 wrote to memory of 1404 2968 cmd.exe 41 PID 2968 wrote to memory of 1404 2968 cmd.exe 41 PID 2968 wrote to memory of 1404 2968 cmd.exe 41 PID 2164 wrote to memory of 1872 2164 taskeng.exe 46 PID 2164 wrote to memory of 1872 2164 taskeng.exe 46 PID 2164 wrote to memory of 1872 2164 taskeng.exe 46 PID 2164 wrote to memory of 1872 2164 taskeng.exe 46 PID 2164 wrote to memory of 2232 2164 taskeng.exe 47 PID 2164 wrote to memory of 2232 2164 taskeng.exe 47 PID 2164 wrote to memory of 2232 2164 taskeng.exe 47 PID 2164 wrote to memory of 2232 2164 taskeng.exe 47 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\valyzt.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2536
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\Installer\MSIE68A.tmp"C:\Windows\Installer\MSIE68A.tmp"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1404
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs5⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000594" "000000000000052C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:660
-
C:\Windows\system32\taskeng.exetaskeng.exe {D576CF92-FAF9-405E-9EFA-6B8A9BD1CD96} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872
-
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
623B
MD5dfc72b801a41a73e3047a0ec2985bf11
SHA1ea72995478ef31c897a9285226f4fcc2b68a79a6
SHA256fd87d6a3e4c850bcdd7146a67661fc41f95f64adecc83dd8b1b04bd40eb1c8e1
SHA5125dcab505b07fe5531e21c174ca2d68f9a5c50e38af39f31811a2894a37493d31912724c77251bbb519a745ca11b5524c7964bd9dbb6ca335a67b76967065218e
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD50517a2ed156e1e4f51845e98fe165d75
SHA1cae7a3cd4f3ec8293c09690b96eb1495aca1e085
SHA256b644348228d2dcc8354f567efa2594931d1fef2f47b9cede3db07c3e0b9f97bc
SHA512b049315c7d25506d8522983fd0b934b04754b692508f2b113e54a3d5f85b828dc157cb3519a6266113b3b369df9bf68a9c7eb7fccedaa2311fc345f488775f25
-
Filesize
1.6MB
MD571386f37f17778126296ca734975db6d
SHA1353818dcd74d06565fc0e8ac4416e594d29ecd0b
SHA256c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae
SHA512e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c
-
Filesize
930KB
MD536f4c5372c6391f782c2db490081746f
SHA1a0b1ec84b0a2db8f801981e247578217b71b38da
SHA2561fe023f69f42fcd4be4baa180bbff00b7ffe51c553211dd0df45fb7ff71148b8
SHA512111c1915d81141398b6bb7a0aa0e98896fb05d5548ace8fd1e0e23343eae60ea1e3d6617d3f5f883b96c8e05f5f868a280683341810896c00fa6ef1f68338992