Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 02:32
Behavioral task
behavioral1
Sample
67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Resource
win10v2004-20241007-en
General
-
Target
67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
-
Size
1.6MB
-
MD5
1585cb2963dceb92fbcf6c4c057e191e
-
SHA1
2063f45e9c82553bbc41cb4bc8e10b2d06d701c9
-
SHA256
67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b
-
SHA512
88475b49d4299519b978711b16e0ea40579a3b671eb898d3d3f8391fbc2de55665bc0a978a20578a4c83f6bf3894a857e4013f34b0e2e4db6de404f66ef9ce47
-
SSDEEP
24576:gnsJ39LyjbJkQFMhmC+6GD9YhloDX0XOf4tHzneKlVLaqueI0psAzrcP39h:gnsHyjtk2MYC5GDyhloJfaelV6skAfX
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WLJOQW.lnk ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe -
Executes dropped EXE 5 IoCs
pid Process 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 4528 Synaptics.exe 3640 ._cache_Synaptics.exe 432 DELPQB.exe 4904 DELPQB.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WLJOQW = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\DELPQB.exe\"" ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3640-199-0x0000000000420000-0x0000000000610000-memory.dmp autoit_exe behavioral2/memory/3772-253-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe behavioral2/memory/3772-255-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe behavioral2/memory/3772-264-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe behavioral2/memory/432-271-0x0000000000310000-0x0000000000500000-memory.dmp autoit_exe behavioral2/memory/3772-274-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe behavioral2/memory/3772-295-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe behavioral2/memory/3772-303-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe behavioral2/memory/4904-308-0x0000000000310000-0x0000000000500000-memory.dmp autoit_exe behavioral2/memory/3772-311-0x00000000005C0000-0x00000000007B0000-memory.dmp autoit_exe -
resource yara_rule behavioral2/files/0x0009000000023c98-5.dat upx behavioral2/memory/3772-70-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/3640-197-0x0000000000420000-0x0000000000610000-memory.dmp upx behavioral2/memory/3640-199-0x0000000000420000-0x0000000000610000-memory.dmp upx behavioral2/memory/3772-253-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/3772-255-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/3772-264-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/432-269-0x0000000000310000-0x0000000000500000-memory.dmp upx behavioral2/memory/432-271-0x0000000000310000-0x0000000000500000-memory.dmp upx behavioral2/memory/3772-274-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/3772-295-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/3772-303-0x00000000005C0000-0x00000000007B0000-memory.dmp upx behavioral2/memory/4904-308-0x0000000000310000-0x0000000000500000-memory.dmp upx behavioral2/memory/3772-311-0x00000000005C0000-0x00000000007B0000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DELPQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DELPQB.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3608 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3100 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5036 wrote to memory of 3772 5036 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 83 PID 5036 wrote to memory of 3772 5036 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 83 PID 5036 wrote to memory of 3772 5036 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 83 PID 5036 wrote to memory of 4528 5036 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 84 PID 5036 wrote to memory of 4528 5036 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 84 PID 5036 wrote to memory of 4528 5036 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 84 PID 3772 wrote to memory of 3372 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 85 PID 3772 wrote to memory of 3372 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 85 PID 3772 wrote to memory of 3372 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 85 PID 3772 wrote to memory of 4428 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 87 PID 3772 wrote to memory of 4428 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 87 PID 3772 wrote to memory of 4428 3772 ._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe 87 PID 3372 wrote to memory of 3608 3372 cmd.exe 88 PID 3372 wrote to memory of 3608 3372 cmd.exe 88 PID 3372 wrote to memory of 3608 3372 cmd.exe 88 PID 4528 wrote to memory of 3640 4528 Synaptics.exe 89 PID 4528 wrote to memory of 3640 4528 Synaptics.exe 89 PID 4528 wrote to memory of 3640 4528 Synaptics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe"C:\Users\Admin\AppData\Local\Temp\67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe"C:\Users\Admin\AppData\Local\Temp\._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn WLJOQW.exe /tr C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WLJOQW.exe /tr C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe /sc minute /mo 14⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3608
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\WLJOQW.vbs3⤵
- System Location Discovery: System Language Discovery
PID:4428
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3100
-
C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exeC:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432
-
C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exeC:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51585cb2963dceb92fbcf6c4c057e191e
SHA12063f45e9c82553bbc41cb4bc8e10b2d06d701c9
SHA25667d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b
SHA51288475b49d4299519b978711b16e0ea40579a3b671eb898d3d3f8391fbc2de55665bc0a978a20578a4c83f6bf3894a857e4013f34b0e2e4db6de404f66ef9ce47
-
C:\Users\Admin\AppData\Local\Temp\._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Filesize898KB
MD566a4951d384b55633ab61add85514f07
SHA1bbf7a65a664bb2b8001576bf670a8381aad3a185
SHA2566068b17cf1c362bfe7736e0b192c362735a040a68a6d41eb8ccdd8be242ca191
SHA512d4dc27627baa28e79ae6dbd375a08c2afb5d47f43dd1c15e41a5033ac3c95bad018ebe5087dafad62fe2266fa7b69599ec2bed92da521208aab5011f854c7123
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
21KB
MD52133aa920bf687cf7ecf068a9cfe064e
SHA15a24d6dd68b5afe0283ba5508760b30cac49cf29
SHA256ae3fe4ff9ab2374a45b56ba8c6f8d28e57cfa598288f0b2285a92884d1e95819
SHA512c25a879b87e0a18d968eb3d65dcd010c3e1ac2e6f00a1cd6d3837dc90db0e7c63f5172385cbe31e3360af7b4d20da6cd17492cd0fb257520182c02c4dccc1209
-
Filesize
964B
MD51fd570ecb5e887b36ecd00b266bf20e7
SHA1eb722165de399367dc99cd3518231fdfa40a0598
SHA256d73308adf382bcd5bb8c692ee8628de2b933a108f3e538aeb7bb41abfba0c3c6
SHA512cd4ee13c9a2f6cef6144174e512721284f15e70401f53187c3c1987e585a977537f7a05a62b1c5fee826530e1f4ba66454f063a500060c4bafb073087c6d23df