Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
0713f3f1c34297d9689ff5b5202c2f37e385109ce493005eb1128ec180d03afd.msi
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
0713f3f1c34297d9689ff5b5202c2f37e385109ce493005eb1128ec180d03afd.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
0713f3f1c34297d9689ff5b5202c2f37e385109ce493005eb1128ec180d03afd.msi
-
Size
1.7MB
-
MD5
251eff52580900a708bc33aa5ac20707
-
SHA1
ff2848350a329b3fd9d460e40d898962899e5b4d
-
SHA256
0713f3f1c34297d9689ff5b5202c2f37e385109ce493005eb1128ec180d03afd
-
SHA512
f0d4501af1d323347aab94eb35c94980fdbade725e7f3e061835cd322ae6333877fb6e0d0ecf73cdebeab40c4fdf1e9acf0c6b5ce85afd51d0a37ddcaf4c7d94
-
SSDEEP
49152:xERnsHyjtk2MYC5GDIhloJfAAR/sTEsiwg6gpWacS:knsmtk2aFhlZUETE9wg5
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAIVZU.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIC055.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\VAIVZU = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\HWCCVS.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2032-110-0x0000000000AE0000-0x0000000000CDE000-memory.dmp autoit_exe behavioral1/memory/2032-112-0x0000000000AE0000-0x0000000000CDE000-memory.dmp autoit_exe behavioral1/memory/1564-114-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe behavioral1/memory/1564-116-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe behavioral1/memory/1564-121-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe behavioral1/memory/1564-123-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe behavioral1/memory/1472-166-0x0000000000B20000-0x0000000000D1E000-memory.dmp autoit_exe behavioral1/memory/1564-168-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe behavioral1/memory/1564-174-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe behavioral1/memory/2472-181-0x0000000000E50000-0x000000000104E000-memory.dmp autoit_exe behavioral1/memory/1564-183-0x0000000000EB0000-0x00000000010AE000-memory.dmp autoit_exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe File created C:\Windows\SysWOW64\._cache_MSIC055.tmp MSIC055.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSIC055.tmp MSIC055.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral1/files/0x000600000001a41c-46.dat upx behavioral1/memory/1564-54-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/2032-110-0x0000000000AE0000-0x0000000000CDE000-memory.dmp upx behavioral1/memory/2032-112-0x0000000000AE0000-0x0000000000CDE000-memory.dmp upx behavioral1/memory/1564-114-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/1564-116-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/1564-121-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/1564-123-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/1472-164-0x0000000000B20000-0x0000000000D1E000-memory.dmp upx behavioral1/memory/1472-166-0x0000000000B20000-0x0000000000D1E000-memory.dmp upx behavioral1/memory/1564-168-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/1564-174-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx behavioral1/memory/2472-180-0x0000000000E50000-0x000000000104E000-memory.dmp upx behavioral1/memory/2472-181-0x0000000000E50000-0x000000000104E000-memory.dmp upx behavioral1/memory/1564-183-0x0000000000EB0000-0x00000000010AE000-memory.dmp upx -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76be40.msi msiexec.exe File opened for modification C:\Windows\Installer\f76be40.msi msiexec.exe File created C:\Windows\Installer\f76be43.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBF97.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC055.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76be43.ipi msiexec.exe -
Executes dropped EXE 6 IoCs
pid Process 2676 MSIC055.tmp 1316 Synaptics.exe 1564 ._cache_Synaptics.exe 2032 HWCCVS.exe 1472 HWCCVS.exe 2472 HWCCVS.exe -
Loads dropped DLL 5 IoCs
pid Process 2676 MSIC055.tmp 2676 MSIC055.tmp 1316 Synaptics.exe 1316 Synaptics.exe 1564 ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1732 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCCVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIC055.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCCVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCCVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1940 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1124 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 msiexec.exe 1720 msiexec.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe 1564 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1564 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 1732 msiexec.exe Token: SeIncreaseQuotaPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeSecurityPrivilege 1720 msiexec.exe Token: SeCreateTokenPrivilege 1732 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1732 msiexec.exe Token: SeLockMemoryPrivilege 1732 msiexec.exe Token: SeIncreaseQuotaPrivilege 1732 msiexec.exe Token: SeMachineAccountPrivilege 1732 msiexec.exe Token: SeTcbPrivilege 1732 msiexec.exe Token: SeSecurityPrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeLoadDriverPrivilege 1732 msiexec.exe Token: SeSystemProfilePrivilege 1732 msiexec.exe Token: SeSystemtimePrivilege 1732 msiexec.exe Token: SeProfSingleProcessPrivilege 1732 msiexec.exe Token: SeIncBasePriorityPrivilege 1732 msiexec.exe Token: SeCreatePagefilePrivilege 1732 msiexec.exe Token: SeCreatePermanentPrivilege 1732 msiexec.exe Token: SeBackupPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeShutdownPrivilege 1732 msiexec.exe Token: SeDebugPrivilege 1732 msiexec.exe Token: SeAuditPrivilege 1732 msiexec.exe Token: SeSystemEnvironmentPrivilege 1732 msiexec.exe Token: SeChangeNotifyPrivilege 1732 msiexec.exe Token: SeRemoteShutdownPrivilege 1732 msiexec.exe Token: SeUndockPrivilege 1732 msiexec.exe Token: SeSyncAgentPrivilege 1732 msiexec.exe Token: SeEnableDelegationPrivilege 1732 msiexec.exe Token: SeManageVolumePrivilege 1732 msiexec.exe Token: SeImpersonatePrivilege 1732 msiexec.exe Token: SeCreateGlobalPrivilege 1732 msiexec.exe Token: SeBackupPrivilege 2256 vssvc.exe Token: SeRestorePrivilege 2256 vssvc.exe Token: SeAuditPrivilege 2256 vssvc.exe Token: SeBackupPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 2892 DrvInst.exe Token: SeLoadDriverPrivilege 2892 DrvInst.exe Token: SeLoadDriverPrivilege 2892 DrvInst.exe Token: SeLoadDriverPrivilege 2892 DrvInst.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1732 msiexec.exe 1732 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1124 EXCEL.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2676 1720 msiexec.exe 34 PID 1720 wrote to memory of 2676 1720 msiexec.exe 34 PID 1720 wrote to memory of 2676 1720 msiexec.exe 34 PID 1720 wrote to memory of 2676 1720 msiexec.exe 34 PID 2676 wrote to memory of 1316 2676 MSIC055.tmp 35 PID 2676 wrote to memory of 1316 2676 MSIC055.tmp 35 PID 2676 wrote to memory of 1316 2676 MSIC055.tmp 35 PID 2676 wrote to memory of 1316 2676 MSIC055.tmp 35 PID 1316 wrote to memory of 1564 1316 Synaptics.exe 36 PID 1316 wrote to memory of 1564 1316 Synaptics.exe 36 PID 1316 wrote to memory of 1564 1316 Synaptics.exe 36 PID 1316 wrote to memory of 1564 1316 Synaptics.exe 36 PID 1564 wrote to memory of 2076 1564 ._cache_Synaptics.exe 38 PID 1564 wrote to memory of 2076 1564 ._cache_Synaptics.exe 38 PID 1564 wrote to memory of 2076 1564 ._cache_Synaptics.exe 38 PID 1564 wrote to memory of 2076 1564 ._cache_Synaptics.exe 38 PID 1564 wrote to memory of 1592 1564 ._cache_Synaptics.exe 40 PID 1564 wrote to memory of 1592 1564 ._cache_Synaptics.exe 40 PID 1564 wrote to memory of 1592 1564 ._cache_Synaptics.exe 40 PID 1564 wrote to memory of 1592 1564 ._cache_Synaptics.exe 40 PID 2076 wrote to memory of 1940 2076 cmd.exe 41 PID 2076 wrote to memory of 1940 2076 cmd.exe 41 PID 2076 wrote to memory of 1940 2076 cmd.exe 41 PID 2076 wrote to memory of 1940 2076 cmd.exe 41 PID 2600 wrote to memory of 2032 2600 taskeng.exe 45 PID 2600 wrote to memory of 2032 2600 taskeng.exe 45 PID 2600 wrote to memory of 2032 2600 taskeng.exe 45 PID 2600 wrote to memory of 2032 2600 taskeng.exe 45 PID 2600 wrote to memory of 1472 2600 taskeng.exe 47 PID 2600 wrote to memory of 1472 2600 taskeng.exe 47 PID 2600 wrote to memory of 1472 2600 taskeng.exe 47 PID 2600 wrote to memory of 1472 2600 taskeng.exe 47 PID 2600 wrote to memory of 2472 2600 taskeng.exe 48 PID 2600 wrote to memory of 2472 2600 taskeng.exe 48 PID 2600 wrote to memory of 2472 2600 taskeng.exe 48 PID 2600 wrote to memory of 2472 2600 taskeng.exe 48 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0713f3f1c34297d9689ff5b5202c2f37e385109ce493005eb1128ec180d03afd.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1732
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\Installer\MSIC055.tmp"C:\Windows\Installer\MSIC055.tmp"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn VAIVZU.exe /tr C:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn VAIVZU.exe /tr C:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1940
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\VAIVZU.vbs5⤵
- System Location Discovery: System Language Discovery
PID:1592
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000590" "00000000000003C0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1124
-
C:\Windows\system32\taskeng.exetaskeng.exe {D6424E16-1A5C-4926-BD57-BD43135CC52C} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exeC:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2032
-
-
C:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exeC:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472
-
-
C:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exeC:\Users\Admin\AppData\Roaming\Windata\HWCCVS.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
681B
MD5d39a489fdae93377f723e360bf8f62bf
SHA19598f91ac52412ce049cc98dbd7315677f874c7d
SHA2561279355fdd6cd330d55cd1d554208e4fe7d63ef7994770b2cd500cea1bbc552e
SHA5120213346bdcc7d337b70e2775a77738747f2c5fc2fae7f739239379db504c0191b403ee348adeff7319e974a34fa915bf14f1b3e94e7da1e092bb646962f8674d
-
Filesize
25KB
MD5ba0bfa247b157b4fedbb823d6e3cf531
SHA1326bc83f81fb3d3cf88ac278f319780732288348
SHA2562bb92b5292d0f3ade7e8f17c93a58200b3bf3d969ac5a9b7e01c2064e67c26d0
SHA51234b144f846525e168bbd28a58be605e6d2934bc5f7fdcc4de00b2d80a7e3972d41dc920f6cfad389c5f85567b5b33ad2bf89d245b98f416d02f2aec286536770
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
1.6MB
MD56ae1479d38c7cb94c69b68d6f8678129
SHA10be3abad5d5f32440715b33052ce7df3059c5281
SHA25687e0b788c004b6a9c0796fc7d60c61f10070025440e34725d1519e6b76a99f1f
SHA512e55d621b2c49333cf980764c5d03c50d7cb9af3742b4f7b6801240461c275988ac4e9815c9ccd8606364de5d8efd94c08f9da6f6cb182955dda3ff49a21d31e3
-
Filesize
922KB
MD5e759447d66ae14246646cf49367e7c49
SHA10cd114480c8cced2b3f4c94fe8379e2a80c0159e
SHA256bfe82a1cab90661d6074e52f9600e1940259be463c0b4510ae065093bc9892a9
SHA512f3ee228c6bdbbcfcc9f827000c259dc8dce9832b7f8bf02d2cef1d3260de235900fa05d62b53049f50fea3fda163f36d6d92d22965be665420ec2ffc511254ea