Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8.msi
Resource
win7-20241010-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8.msi
-
Size
1.7MB
-
MD5
53614b87538306b4f7437db8be2a0e47
-
SHA1
a6a777b24bb64067738386caa66787b8ed225726
-
SHA256
e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8
-
SHA512
cfed71c6b9eb55b3ebfb53cbdb1611e8921a6dbe7b7efc5456cebb9bfb3d6a64f23a97c63415d61c38c4e3b540a79fd50cb2a080220bf3ea32edc98f85e6ecc1
-
SSDEEP
49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBMQLS.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIC99A.tmp Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBMQLS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EWZJGF.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1468-172-0x00000000009F0000-0x0000000000BF0000-memory.dmp autoit_exe behavioral2/memory/1468-171-0x00000000009F0000-0x0000000000BF0000-memory.dmp autoit_exe behavioral2/memory/1468-178-0x00000000009F0000-0x0000000000BF0000-memory.dmp autoit_exe behavioral2/memory/4688-187-0x00000000008C0000-0x0000000000AC0000-memory.dmp autoit_exe behavioral2/memory/1468-211-0x00000000009F0000-0x0000000000BF0000-memory.dmp autoit_exe behavioral2/memory/1468-217-0x00000000009F0000-0x0000000000BF0000-memory.dmp autoit_exe behavioral2/memory/1868-221-0x00000000008C0000-0x0000000000AC0000-memory.dmp autoit_exe behavioral2/memory/1468-225-0x00000000009F0000-0x0000000000BF0000-memory.dmp autoit_exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation MSIC99A.tmp Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe File created C:\Windows\SysWOW64\._cache_MSIC99A.tmp MSIC99A.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSIC99A.tmp MSIC99A.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral2/files/0x000b000000023bd2-96.dat upx behavioral2/memory/1468-154-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx behavioral2/memory/1468-172-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx behavioral2/memory/1468-171-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx behavioral2/memory/1468-178-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx behavioral2/memory/4688-186-0x00000000008C0000-0x0000000000AC0000-memory.dmp upx behavioral2/memory/4688-187-0x00000000008C0000-0x0000000000AC0000-memory.dmp upx behavioral2/memory/1468-211-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx behavioral2/memory/1468-217-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx behavioral2/memory/1868-221-0x00000000008C0000-0x0000000000AC0000-memory.dmp upx behavioral2/memory/1468-225-0x00000000009F0000-0x0000000000BF0000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSIC92C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC99A.tmp msiexec.exe File created C:\Windows\Installer\e57c861.msi msiexec.exe File opened for modification C:\Windows\Installer\e57c861.msi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 4944 MSIC99A.tmp 4504 Synaptics.exe 1468 ._cache_Synaptics.exe 4688 EWZJGF.exe 1868 EWZJGF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4456 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWZJGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIC99A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fc5eef0dbaffe7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fc5eef00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009fc5eef0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fc5eef0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fc5eef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MSIC99A.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4572 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 msiexec.exe 4508 msiexec.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe 1468 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1468 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 4456 msiexec.exe Token: SeIncreaseQuotaPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4508 msiexec.exe Token: SeCreateTokenPrivilege 4456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4456 msiexec.exe Token: SeLockMemoryPrivilege 4456 msiexec.exe Token: SeIncreaseQuotaPrivilege 4456 msiexec.exe Token: SeMachineAccountPrivilege 4456 msiexec.exe Token: SeTcbPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeLoadDriverPrivilege 4456 msiexec.exe Token: SeSystemProfilePrivilege 4456 msiexec.exe Token: SeSystemtimePrivilege 4456 msiexec.exe Token: SeProfSingleProcessPrivilege 4456 msiexec.exe Token: SeIncBasePriorityPrivilege 4456 msiexec.exe Token: SeCreatePagefilePrivilege 4456 msiexec.exe Token: SeCreatePermanentPrivilege 4456 msiexec.exe Token: SeBackupPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeShutdownPrivilege 4456 msiexec.exe Token: SeDebugPrivilege 4456 msiexec.exe Token: SeAuditPrivilege 4456 msiexec.exe Token: SeSystemEnvironmentPrivilege 4456 msiexec.exe Token: SeChangeNotifyPrivilege 4456 msiexec.exe Token: SeRemoteShutdownPrivilege 4456 msiexec.exe Token: SeUndockPrivilege 4456 msiexec.exe Token: SeSyncAgentPrivilege 4456 msiexec.exe Token: SeEnableDelegationPrivilege 4456 msiexec.exe Token: SeManageVolumePrivilege 4456 msiexec.exe Token: SeImpersonatePrivilege 4456 msiexec.exe Token: SeCreateGlobalPrivilege 4456 msiexec.exe Token: SeBackupPrivilege 3080 vssvc.exe Token: SeRestorePrivilege 3080 vssvc.exe Token: SeAuditPrivilege 3080 vssvc.exe Token: SeBackupPrivilege 4508 msiexec.exe Token: SeRestorePrivilege 4508 msiexec.exe Token: SeRestorePrivilege 4508 msiexec.exe Token: SeTakeOwnershipPrivilege 4508 msiexec.exe Token: SeRestorePrivilege 4508 msiexec.exe Token: SeTakeOwnershipPrivilege 4508 msiexec.exe Token: SeRestorePrivilege 4508 msiexec.exe Token: SeTakeOwnershipPrivilege 4508 msiexec.exe Token: SeBackupPrivilege 4300 srtasks.exe Token: SeRestorePrivilege 4300 srtasks.exe Token: SeSecurityPrivilege 4300 srtasks.exe Token: SeTakeOwnershipPrivilege 4300 srtasks.exe Token: SeBackupPrivilege 4300 srtasks.exe Token: SeRestorePrivilege 4300 srtasks.exe Token: SeSecurityPrivilege 4300 srtasks.exe Token: SeTakeOwnershipPrivilege 4300 srtasks.exe Token: SeRestorePrivilege 4508 msiexec.exe Token: SeTakeOwnershipPrivilege 4508 msiexec.exe Token: SeRestorePrivilege 4508 msiexec.exe Token: SeTakeOwnershipPrivilege 4508 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4456 msiexec.exe 4456 msiexec.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4508 wrote to memory of 4300 4508 msiexec.exe 93 PID 4508 wrote to memory of 4300 4508 msiexec.exe 93 PID 4508 wrote to memory of 4944 4508 msiexec.exe 96 PID 4508 wrote to memory of 4944 4508 msiexec.exe 96 PID 4508 wrote to memory of 4944 4508 msiexec.exe 96 PID 4944 wrote to memory of 4504 4944 MSIC99A.tmp 97 PID 4944 wrote to memory of 4504 4944 MSIC99A.tmp 97 PID 4944 wrote to memory of 4504 4944 MSIC99A.tmp 97 PID 4504 wrote to memory of 1468 4504 Synaptics.exe 98 PID 4504 wrote to memory of 1468 4504 Synaptics.exe 98 PID 4504 wrote to memory of 1468 4504 Synaptics.exe 98 PID 1468 wrote to memory of 228 1468 ._cache_Synaptics.exe 100 PID 1468 wrote to memory of 228 1468 ._cache_Synaptics.exe 100 PID 1468 wrote to memory of 228 1468 ._cache_Synaptics.exe 100 PID 1468 wrote to memory of 4328 1468 ._cache_Synaptics.exe 102 PID 1468 wrote to memory of 4328 1468 ._cache_Synaptics.exe 102 PID 1468 wrote to memory of 4328 1468 ._cache_Synaptics.exe 102 PID 228 wrote to memory of 4572 228 cmd.exe 103 PID 228 wrote to memory of 4572 228 cmd.exe 103 PID 228 wrote to memory of 4572 228 cmd.exe 103 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4456
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\Installer\MSIC99A.tmp"C:\Windows\Installer\MSIC99A.tmp"2⤵
- Adds Run key to start application
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4572
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs5⤵
- System Location Discovery: System Language Discovery
PID:4328
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3564
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4688
-
C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exeC:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
681B
MD5f044ba89bb1d45ca0925f71fb53703bf
SHA136c6a570264ce377d3511e2c1dbcea2567255671
SHA256e6c911f83d14745ea9e042af0b2fc0261ec1a41ceef26f773c27ffeb6668d4ec
SHA5120d82f977921243e96ffce65deed2b1e44f3c2c02aee13dd49927d4900680dde83a3dce3e421c4381b907ec26a73812511121966d4224e1f62b12bea60d8ba059
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
1.6MB
MD571386f37f17778126296ca734975db6d
SHA1353818dcd74d06565fc0e8ac4416e594d29ecd0b
SHA256c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae
SHA512e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c
-
Filesize
930KB
MD536f4c5372c6391f782c2db490081746f
SHA1a0b1ec84b0a2db8f801981e247578217b71b38da
SHA2561fe023f69f42fcd4be4baa180bbff00b7ffe51c553211dd0df45fb7ff71148b8
SHA512111c1915d81141398b6bb7a0aa0e98896fb05d5548ace8fd1e0e23343eae60ea1e3d6617d3f5f883b96c8e05f5f868a280683341810896c00fa6ef1f68338992
-
Filesize
24.1MB
MD56b8bfa8be0bac0919fbdedeab75ee25b
SHA172edc39e6ca0e79148c61bc73a5b4d1498e36e43
SHA256aaff64437cbb3b457c488022fbaf448c90ddfdf2ce863dfe56c29b589d0be7ec
SHA51296e1e0ae52c35504e9b39de89d7b7940d03145dacf30e13c837ea4f46031bb2a4295d5da303a0cdf60730a6760d22490ad2023a28eadd2639ad73a53022e34cf
-
\??\Volume{f0eec59f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2d702e78-3b2e-43a4-b958-f1470ab603f7}_OnDiskSnapshotProp
Filesize6KB
MD5100c99cef1a6225f509d7ca03e2098f4
SHA11f9a47ef8ade0d61399148ae9e56b00d3fa29e1b
SHA256c0194bd5775fa4dff2f84fc896c5d6ac39d68a1b1501e423e5ac7d2926ea7a77
SHA5128bd01f4d6bca5c62f6c218c5a16d859d154c8f7233b5b2f19c2d32b569c7d472b706f8c83675e358318200625eb7d8d1234e0fce06c6c94a32d1d106fb0f3722