Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
30/12/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
valyzt.msi
Resource
win7-20241023-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
valyzt.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target valyzt.msi
- Size 1.7MB
- Sample241230-mkdrnsvkdr
- SHA256 e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8
- MD5 53614b87538306b4f7437db8be2a0e47
- SHA1 a6a777b24bb64067738386caa66787b8ed225726
- SHA512 cfed71c6b9eb55b3ebfb53cbdb1611e8921a6dbe7b7efc5456cebb9bfb3d6a64f23a97c63415d61c38c4e3b540a79fd50cb2a080220bf3ea32edc98f85e6ecc1
- SSDEEP 49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Xred family
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBMQLS.lnk ._cache_Synaptics.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSI9C22.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBMQLS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EWZJGF.exe\"" ._cache_Synaptics.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe - AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3276-227-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-228-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-230-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-232-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/4980-236-0x0000000000F50000-0x0000000001150000-memory.dmp autoit_exe behavioral2/memory/3276-238-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-243-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-247-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-267-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-269-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-271-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/4688-273-0x0000000000F50000-0x0000000001150000-memory.dmp autoit_exe behavioral2/memory/3276-275-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-277-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-279-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe behavioral2/memory/3276-281-0x0000000000620000-0x0000000000820000-memory.dmp autoit_exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation MSI9C22.tmp Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Synaptics.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe File created C:\Windows\SysWOW64\._cache_MSI9C22.tmp MSI9C22.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSI9C22.tmp MSI9C22.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral2/files/0x000e000000023b69-94.dat upx behavioral2/memory/3276-152-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-227-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-228-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-230-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-232-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/4980-234-0x0000000000F50000-0x0000000001150000-memory.dmp upx behavioral2/memory/4980-236-0x0000000000F50000-0x0000000001150000-memory.dmp upx behavioral2/memory/3276-238-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-243-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-247-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-267-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-269-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-271-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/4688-273-0x0000000000F50000-0x0000000001150000-memory.dmp upx behavioral2/memory/3276-275-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-277-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-279-0x0000000000620000-0x0000000000820000-memory.dmp upx behavioral2/memory/3276-281-0x0000000000620000-0x0000000000820000-memory.dmp upx - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSI9BD2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C22.tmp msiexec.exe File created C:\Windows\Installer\e579ae8.msi msiexec.exe File opened for modification C:\Windows\Installer\e579ae8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Executes dropped EXE 5 IoCs
pid Process 768 MSI9C22.tmp 3912 Synaptics.exe 3276 ._cache_Synaptics.exe 4980 EWZJGF.exe 4688 EWZJGF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2520 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI9C22.tmp - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d4141155d34ac580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d4141150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d414115000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d414115000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d41411500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MSI9C22.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2560 schtasks.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1536 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2484 msiexec.exe 2484 msiexec.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe 3276 ._cache_Synaptics.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3276 ._cache_Synaptics.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 2520 msiexec.exe Token: SeIncreaseQuotaPrivilege 2520 msiexec.exe Token: SeSecurityPrivilege 2484 msiexec.exe Token: SeCreateTokenPrivilege 2520 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2520 msiexec.exe Token: SeLockMemoryPrivilege 2520 msiexec.exe Token: SeIncreaseQuotaPrivilege 2520 msiexec.exe Token: SeMachineAccountPrivilege 2520 msiexec.exe Token: SeTcbPrivilege 2520 msiexec.exe Token: SeSecurityPrivilege 2520 msiexec.exe Token: SeTakeOwnershipPrivilege 2520 msiexec.exe Token: SeLoadDriverPrivilege 2520 msiexec.exe Token: SeSystemProfilePrivilege 2520 msiexec.exe Token: SeSystemtimePrivilege 2520 msiexec.exe Token: SeProfSingleProcessPrivilege 2520 msiexec.exe Token: SeIncBasePriorityPrivilege 2520 msiexec.exe Token: SeCreatePagefilePrivilege 2520 msiexec.exe Token: SeCreatePermanentPrivilege 2520 msiexec.exe Token: SeBackupPrivilege 2520 msiexec.exe Token: SeRestorePrivilege 2520 msiexec.exe Token: SeShutdownPrivilege 2520 msiexec.exe Token: SeDebugPrivilege 2520 msiexec.exe Token: SeAuditPrivilege 2520 msiexec.exe Token: SeSystemEnvironmentPrivilege 2520 msiexec.exe Token: SeChangeNotifyPrivilege 2520 msiexec.exe Token: SeRemoteShutdownPrivilege 2520 msiexec.exe Token: SeUndockPrivilege 2520 msiexec.exe Token: SeSyncAgentPrivilege 2520 msiexec.exe Token: SeEnableDelegationPrivilege 2520 msiexec.exe Token: SeManageVolumePrivilege 2520 msiexec.exe Token: SeImpersonatePrivilege 2520 msiexec.exe Token: SeCreateGlobalPrivilege 2520 msiexec.exe Token: SeBackupPrivilege 4644 vssvc.exe Token: SeRestorePrivilege 4644 vssvc.exe Token: SeAuditPrivilege 4644 vssvc.exe Token: SeBackupPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeBackupPrivilege 720 srtasks.exe Token: SeRestorePrivilege 720 srtasks.exe Token: SeSecurityPrivilege 720 srtasks.exe Token: SeTakeOwnershipPrivilege 720 srtasks.exe Token: SeBackupPrivilege 720 srtasks.exe Token: SeRestorePrivilege 720 srtasks.exe Token: SeSecurityPrivilege 720 srtasks.exe Token: SeTakeOwnershipPrivilege 720 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2520 msiexec.exe 2520 msiexec.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE 1536 EXCEL.EXE - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2484 wrote to memory of 720 2484 msiexec.exe 91 PID 2484 wrote to memory of 720 2484 msiexec.exe 91 PID 2484 wrote to memory of 768 2484 msiexec.exe 94 PID 2484 wrote to memory of 768 2484 msiexec.exe 94 PID 2484 wrote to memory of 768 2484 msiexec.exe 94 PID 768 wrote to memory of 3912 768 MSI9C22.tmp 96 PID 768 wrote to memory of 3912 768 MSI9C22.tmp 96 PID 768 wrote to memory of 3912 768 MSI9C22.tmp 96 PID 3912 wrote to memory of 3276 3912 Synaptics.exe 97 PID 3912 wrote to memory of 3276 3912 Synaptics.exe 97 PID 3912 wrote to memory of 3276 3912 Synaptics.exe 97 PID 3276 wrote to memory of 3132 3276 ._cache_Synaptics.exe 99 PID 3276 wrote to memory of 3132 3276 ._cache_Synaptics.exe 99 PID 3276 wrote to memory of 3132 3276 ._cache_Synaptics.exe 99 PID 3276 wrote to memory of 2300 3276 ._cache_Synaptics.exe 101 PID 3276 wrote to memory of 2300 3276 ._cache_Synaptics.exe 101 PID 3276 wrote to memory of 2300 3276 ._cache_Synaptics.exe 101 PID 3132 wrote to memory of 2560 3132 cmd.exe 102 PID 3132 wrote to memory of 2560 3132 cmd.exe 102 PID 3132 wrote to memory of 2560 3132 cmd.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\valyzt.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2520
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
C:\Windows\Installer\MSI9C22.tmp"C:\Windows\Installer\MSI9C22.tmp"2⤵
- Adds Run key to start application
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2560
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs5⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1536
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4688
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e579aeb.rbs
- Size 623B
- SHA256 580e0b07818fd19cf2a94f877449e4fe6233c06b26ee808fdcf3f2e59d48d2aa
- MD5 f07629fc966d3a1e499aae507f2e2838
- SHA1 e01bb5e700f31c9d2a331395ef241993cac547b0
- SHA512 b5d2912c6837dd806acfe334f1d2daf853ee5b5195746a444ba8e3d49b352ecc6067ffc9f6a35ba3acd0809ebbe627306f6229fa8a8d5312f8f383016874dcac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\29A75E00
- Size 26KB
- SHA256 8c9043155df56e472823cf53548f81a0c58156893a2e3676920bf7156877b9fa
- MD5 306452c753df6a418208399a9097e141
- SHA1 52e4f8871e9612dcc1f2fc6330ef595d3ea7b9b6
- SHA512 b619406e70bb9dd069379b30af1c334c265bedb2262ecefcb07589927d7da1f47502f62c1f85527794f954961f86fa4b0c83cc68353d1377b08e6b3ab22a988c
- SSDEEP 384:M3V/7W3VJp9F5mB8p+o5bC7ZqN6o8y0tDxlrC4MaGEdoECrnnVHvwFUaGo0ZFsG6:Mlu9Fa84o5bjNxm3k9Er6negowjqeZdA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs
- Size 840B
- SHA256 cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
- MD5 89137407cd4107effa2ff9f29a2a99ad
- SHA1 99814ebc80118160841a2cf0f29eb578b57e4ac6
- SHA512 d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\uzGhlCnd.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI9C22.tmp
- Size 1.6MB
- SHA256 c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae
- MD5 71386f37f17778126296ca734975db6d
- SHA1 353818dcd74d06565fc0e8ac4416e594d29ecd0b
- SHA512 e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c
- SSDEEP 49152:gnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZlO:gnsmtk2a1hlPERBsiTs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\._cache_Synaptics.exe
- Size 930KB
- SHA256 1fe023f69f42fcd4be4baa180bbff00b7ffe51c553211dd0df45fb7ff71148b8
- MD5 36f4c5372c6391f782c2db490081746f
- SHA1 a0b1ec84b0a2db8f801981e247578217b71b38da
- SHA512 111c1915d81141398b6bb7a0aa0e98896fb05d5548ace8fd1e0e23343eae60ea1e3d6617d3f5f883b96c8e05f5f868a280683341810896c00fa6ef1f68338992
- SSDEEP 24576:ZhloDX0XOf4LvPAXY3+3NRMaqIL90KNUFmX1tqqNZlz:ZhloJfCAh9RMUBrNUFqtBZl
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 53a29bcbf498cdb591c023c144375e5cef8a49c6800f8b6290d9e988571fd4ee
- MD5 fa67476d767c3f904e500242857b84bc
- SHA1 84d3dc8f4eac1e01c3cabaab7d294ab32e5b69da
- SHA512 97c7d6a1fca8cb84137306519e34f8aeb90085af87f4b882ec90ffc759231e351420be4b9bcd2e53a759b0bf467898d717f6f872b5a4f98bf196b2582ad0665d
- SSDEEP 24576:sZxm+1aWdoO/vvTLnW0ex2KgFtnxcF8y4CGN2L11sUq1ez954PlHsS/B7l:Sx
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ee2a8135-7c6b-48a5-9371-3f4184b689ba}_OnDiskSnapshotProp
- Size 6KB
- SHA256 167e6ce98aade47be06e7cdc804bf1c4cec791146b0f1e13753ae335c8693472
- MD5 8370ac9c88c32bfad4f1054728e98933
- SHA1 f852091084b336327581b343b5ceca076bf25cab
- SHA512 7558afad69e4d13a5db2b4b54252888146da37d02f8df116e18a6b73a9ef25e513973df25f7003adcec992fdae86279c09a7cac3bf9be77ba340fd0ef3daf0b9
- SSDEEP 96:FYxtwe4wDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpuN:SLb++lVmN
- MD5 SHA1 SHA512 SSDEEP