Malware Analysis Report

2025-04-13 21:03

Sample ID 250102-xxn4aavnfp
Target file.exe
SHA256 70c87af178a804f97a312d3d8d509d5c6f4a54ac07d08bacf858e6687de7e435
Tags
xred backdoor discovery persistence macro
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70c87af178a804f97a312d3d8d509d5c6f4a54ac07d08bacf858e6687de7e435

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

xred backdoor discovery persistence macro

Xred family

Xred

Suspicious Office macro

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Checks installed software on the system

Adds Run key to start application

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-02 19:14

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-02 19:14

Reported

2025-01-02 19:16

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\{2E84A4A1-A337-4A15-868B-C4CD02467330}\.cr\._cache_Synaptics.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1996 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 1996 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 1996 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 4660 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe
PID 4660 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe
PID 4660 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe
PID 1996 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1996 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1996 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3936 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3936 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3936 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3036 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{2E84A4A1-A337-4A15-868B-C4CD02467330}\.cr\._cache_Synaptics.exe
PID 3036 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{2E84A4A1-A337-4A15-868B-C4CD02467330}\.cr\._cache_Synaptics.exe
PID 3036 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{2E84A4A1-A337-4A15-868B-C4CD02467330}\.cr\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_file.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_file.exe"

C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe

"C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\._cache_file.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Windows\Temp\{2E84A4A1-A337-4A15-868B-C4CD02467330}\.cr\._cache_Synaptics.exe

"C:\Windows\Temp\{2E84A4A1-A337-4A15-868B-C4CD02467330}\.cr\._cache_Synaptics.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" -burn.filehandle.attached=656 -burn.filehandle.self=684 InjUpdate

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 40.173.79.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/1996-0-0x0000000001580000-0x0000000001581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_file.exe

MD5 de34b1c517e0463602624bbc8294c08d
SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac

C:\Windows\Temp\{BAA65104-1663-453A-8847-7753AEE5C699}\.cr\._cache_file.exe

MD5 2f9d2b6ce54f9095695b53d1aa217c7b
SHA1 3f54934c240f1955301811d2c399728a3e6d1272
SHA256 0009d3f27837c3af3f6fff7973faf07afaa4b53119846f55b6f2a79f1759c757
SHA512 692857f960f26039c7b0af6329e65a71e8588ff71eaac6b956bd6e437994a8d5a470c7e75dd776e0772e473967b64d5ea0e1d8396546691316daf4d6b8ccc237

C:\ProgramData\Synaptics\Synaptics.exe

MD5 7274b0b15c4e6d5bbe8db5aa93c65a12
SHA1 643418b70ee7242fb4cf797e54ec78c910d32824
SHA256 70c87af178a804f97a312d3d8d509d5c6f4a54ac07d08bacf858e6687de7e435
SHA512 241ca5eaa520a22a1c264f2fd3307c95d78fb56c2433602e42dcf9f2eb419ed2d43d40f6524a61a1d6e696375f7ea722fd502fa939d4453d88ca63ac068be224

C:\Windows\Temp\{83C9CAC2-D94D-4ECD-B293-CE2ED96D5ED6}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{83C9CAC2-D94D-4ECD-B293-CE2ED96D5ED6}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

memory/1996-175-0x0000000000400000-0x0000000001281000-memory.dmp

memory/884-242-0x00007FFB8B8F0000-0x00007FFB8B900000-memory.dmp

memory/884-244-0x00007FFB8B8F0000-0x00007FFB8B900000-memory.dmp

memory/884-243-0x00007FFB8B8F0000-0x00007FFB8B900000-memory.dmp

memory/884-241-0x00007FFB8B8F0000-0x00007FFB8B900000-memory.dmp

memory/884-240-0x00007FFB8B8F0000-0x00007FFB8B900000-memory.dmp

memory/884-287-0x00007FFB89420000-0x00007FFB89430000-memory.dmp

memory/884-289-0x00007FFB89420000-0x00007FFB89430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\roRc4s7I.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/3936-303-0x0000000000400000-0x0000000001281000-memory.dmp

memory/3936-398-0x0000000000400000-0x0000000001281000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-02 19:14

Reported

2025-01-02 19:16

Platform

win7-20241023-en

Max time kernel

142s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_file.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2364 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2116 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\._cache_file.exe C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe
PID 2364 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2364 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2364 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2364 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2860 wrote to memory of 2496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe
PID 2496 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_file.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_file.exe"

C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe

"C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\._cache_file.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe

"C:\Windows\Temp\{96A6C52E-5832-4732-BF94-1195CA45B4F1}\.cr\._cache_Synaptics.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.143:80 crl.microsoft.com tcp

Files

memory/2364-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_file.exe

MD5 de34b1c517e0463602624bbc8294c08d
SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac

C:\Windows\Temp\{9D405F72-6458-41E9-9B27-AA92D7162D9F}\.cr\._cache_file.exe

MD5 2f9d2b6ce54f9095695b53d1aa217c7b
SHA1 3f54934c240f1955301811d2c399728a3e6d1272
SHA256 0009d3f27837c3af3f6fff7973faf07afaa4b53119846f55b6f2a79f1759c757
SHA512 692857f960f26039c7b0af6329e65a71e8588ff71eaac6b956bd6e437994a8d5a470c7e75dd776e0772e473967b64d5ea0e1d8396546691316daf4d6b8ccc237

C:\ProgramData\Synaptics\Synaptics.exe

MD5 7274b0b15c4e6d5bbe8db5aa93c65a12
SHA1 643418b70ee7242fb4cf797e54ec78c910d32824
SHA256 70c87af178a804f97a312d3d8d509d5c6f4a54ac07d08bacf858e6687de7e435
SHA512 241ca5eaa520a22a1c264f2fd3307c95d78fb56c2433602e42dcf9f2eb419ed2d43d40f6524a61a1d6e696375f7ea722fd502fa939d4453d88ca63ac068be224

\Windows\Temp\{96D0D4DF-26BA-4940-B7F5-6E3FCFCCDD57}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{96D0D4DF-26BA-4940-B7F5-6E3FCFCCDD57}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

memory/2364-75-0x0000000000400000-0x0000000001281000-memory.dmp

memory/1452-135-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iHmRRYOK.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\iHmRRYOK.xlsm

MD5 e64d42ded7003dd8051d2c988b227476
SHA1 ef693102f2789dd4cd94b80153070a8e1c477bb1
SHA256 1c5925a5c2b7544b894e96f9d5bf8f499e33e68912dd5e9c6d8b4b861e17efc5
SHA512 86608a81c21bd2410bd1a272a709cab867753c4522f001881d68750c07a72a623e53e2d27fe5fe5efb14e96d5e7f58ea09746b759613ae68652ecaffa1473852

memory/2860-178-0x0000000000400000-0x0000000001281000-memory.dmp

memory/2860-179-0x0000000000400000-0x0000000001281000-memory.dmp

memory/2860-211-0x0000000000400000-0x0000000001281000-memory.dmp