Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/02/2025, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
0bbe93a978862e8499f795575fe9eb1d.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0bbe93a978862e8499f795575fe9eb1d.vbs
Resource
win10v2004-20250129-en
General
-
Target
0bbe93a978862e8499f795575fe9eb1d.vbs
-
Size
631B
-
MD5
0bbe93a978862e8499f795575fe9eb1d
-
SHA1
995628d7e88ecf1815c7137967fe1a26fe6e2ded
-
SHA256
c50928dd7e0138f769ffdc30d0be023142ab3765371ec5f046c6389801840384
-
SHA512
2b05ad6c70b8f72d917eb239ac3efd3c366663218110000714b1dc499e75dec40529c4480d1d58f9854bd6210a09d1024996ed0df13570db8e05a0cb87d6ad47
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Blocklisted process makes network request 4 IoCs
flow pid Process 5 2912 WScript.exe 7 2912 WScript.exe 9 2912 WScript.exe 11 2912 WScript.exe -
resource behavioral1/files/0x0007000000016d3f-162.dat behavioral1/files/0x0009000000016d3f-184.dat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BZVMYP.lnk ._cache_Acrobat Reader Pro.exe -
Executes dropped EXE 6 IoCs
pid Process 2676 Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 1732 Synaptics.exe 1644 ._cache_Synaptics.exe 2764 QPIQUE.exe 1948 QPIQUE.exe -
Loads dropped DLL 7 IoCs
pid Process 2676 Acrobat Reader Pro.exe 2676 Acrobat Reader Pro.exe 2676 Acrobat Reader Pro.exe 2676 Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 1732 Synaptics.exe 1732 Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" Acrobat Reader Pro.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\BZVMYP = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\QPIQUE.exe\"" ._cache_Acrobat Reader Pro.exe -
AutoIT Executable 20 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1644-111-0x0000000001100000-0x00000000012F0000-memory.dmp autoit_exe behavioral1/memory/1644-113-0x0000000001100000-0x00000000012F0000-memory.dmp autoit_exe behavioral1/memory/2028-189-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-191-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-194-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2764-198-0x0000000001160000-0x0000000001350000-memory.dmp autoit_exe behavioral1/memory/2764-200-0x0000000001160000-0x0000000001350000-memory.dmp autoit_exe behavioral1/memory/2028-201-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-203-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-205-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-209-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-240-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-242-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/1948-247-0x0000000001160000-0x0000000001350000-memory.dmp autoit_exe behavioral1/memory/2028-248-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-250-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-252-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-254-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-256-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe behavioral1/memory/2028-258-0x0000000000060000-0x0000000000250000-memory.dmp autoit_exe -
resource yara_rule behavioral1/files/0x00080000000167dc-67.dat upx behavioral1/memory/2028-81-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/1644-111-0x0000000001100000-0x00000000012F0000-memory.dmp upx behavioral1/memory/1644-113-0x0000000001100000-0x00000000012F0000-memory.dmp upx behavioral1/memory/2028-189-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-191-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-194-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2764-198-0x0000000001160000-0x0000000001350000-memory.dmp upx behavioral1/memory/2764-200-0x0000000001160000-0x0000000001350000-memory.dmp upx behavioral1/memory/2028-201-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-203-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-205-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-209-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-240-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-242-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/1948-245-0x0000000001160000-0x0000000001350000-memory.dmp upx behavioral1/memory/1948-247-0x0000000001160000-0x0000000001350000-memory.dmp upx behavioral1/memory/2028-248-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-250-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-252-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-254-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-256-0x0000000000060000-0x0000000000250000-memory.dmp upx behavioral1/memory/2028-258-0x0000000000060000-0x0000000000250000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acrobat Reader Pro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Acrobat Reader Pro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPIQUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPIQUE.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e WScript.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2 ._cache_Acrobat Reader Pro.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 556 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2956 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe 2028 ._cache_Acrobat Reader Pro.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2028 ._cache_Acrobat Reader Pro.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2956 EXCEL.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2676 2912 WScript.exe 32 PID 2912 wrote to memory of 2676 2912 WScript.exe 32 PID 2912 wrote to memory of 2676 2912 WScript.exe 32 PID 2912 wrote to memory of 2676 2912 WScript.exe 32 PID 2676 wrote to memory of 2028 2676 Acrobat Reader Pro.exe 33 PID 2676 wrote to memory of 2028 2676 Acrobat Reader Pro.exe 33 PID 2676 wrote to memory of 2028 2676 Acrobat Reader Pro.exe 33 PID 2676 wrote to memory of 2028 2676 Acrobat Reader Pro.exe 33 PID 2676 wrote to memory of 1732 2676 Acrobat Reader Pro.exe 34 PID 2676 wrote to memory of 1732 2676 Acrobat Reader Pro.exe 34 PID 2676 wrote to memory of 1732 2676 Acrobat Reader Pro.exe 34 PID 2676 wrote to memory of 1732 2676 Acrobat Reader Pro.exe 34 PID 2028 wrote to memory of 1896 2028 ._cache_Acrobat Reader Pro.exe 35 PID 2028 wrote to memory of 1896 2028 ._cache_Acrobat Reader Pro.exe 35 PID 2028 wrote to memory of 1896 2028 ._cache_Acrobat Reader Pro.exe 35 PID 2028 wrote to memory of 1896 2028 ._cache_Acrobat Reader Pro.exe 35 PID 2028 wrote to memory of 1972 2028 ._cache_Acrobat Reader Pro.exe 37 PID 2028 wrote to memory of 1972 2028 ._cache_Acrobat Reader Pro.exe 37 PID 2028 wrote to memory of 1972 2028 ._cache_Acrobat Reader Pro.exe 37 PID 2028 wrote to memory of 1972 2028 ._cache_Acrobat Reader Pro.exe 37 PID 1896 wrote to memory of 556 1896 cmd.exe 38 PID 1896 wrote to memory of 556 1896 cmd.exe 38 PID 1896 wrote to memory of 556 1896 cmd.exe 38 PID 1896 wrote to memory of 556 1896 cmd.exe 38 PID 1732 wrote to memory of 1644 1732 Synaptics.exe 39 PID 1732 wrote to memory of 1644 1732 Synaptics.exe 39 PID 1732 wrote to memory of 1644 1732 Synaptics.exe 39 PID 1732 wrote to memory of 1644 1732 Synaptics.exe 39 PID 1052 wrote to memory of 2764 1052 taskeng.exe 45 PID 1052 wrote to memory of 2764 1052 taskeng.exe 45 PID 1052 wrote to memory of 2764 1052 taskeng.exe 45 PID 1052 wrote to memory of 2764 1052 taskeng.exe 45 PID 1052 wrote to memory of 1948 1052 taskeng.exe 46 PID 1052 wrote to memory of 1948 1052 taskeng.exe 46 PID 1052 wrote to memory of 1948 1052 taskeng.exe 46 PID 1052 wrote to memory of 1948 1052 taskeng.exe 46
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bbe93a978862e8499f795575fe9eb1d.vbs"1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Roaming\Acrobat Reader Pro.exe"C:\Users\Admin\AppData\Roaming\Acrobat Reader Pro.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\._cache_Acrobat Reader Pro.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Acrobat Reader Pro.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn BZVMYP.exe /tr C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe /sc minute /mo 14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn BZVMYP.exe /tr C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:556
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\BZVMYP.vbs4⤵
- System Location Discovery: System Language Discovery
PID:1972
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2956
-
C:\Windows\system32\taskeng.exetaskeng.exe {07FE25A6-54DB-4FDF-9114-B330DE9A535B} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exeC:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exeC:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa210e236919ccbf95a71a6c0e329c5b
SHA1db5bbd143fcc7d8e4d3257b804c7a6de8edecc16
SHA256dda1491971c93d9c8696c1f88e8233ed842f01876338605481da6a1f3d5e4fe5
SHA512e7268ea9bac4df74ad5579bcf0586098181ed1c4fe7a385395e4e4f679eb95bec608e745af25a3dde97eb8d637b1d5c30148a5d6b662189100f992dbc60bb150
-
Filesize
872B
MD5f04b4b725042839ece8e6e0bfc0c290d
SHA111c84bde6c0c43d618f80e959cfd6052fed1ab22
SHA256225c8e1fb959a96277820cdf50acfbe4c52f637e66e9b1fa3efb244eb4624f7e
SHA5122dfeaea3cc25f697f043fa32379aaaae8c9c3492b8c67d90fe5bd44198624687330bdda9d9c270342ac744b6015d11662a91a614b9061e372897ab41df3719a2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD5c31a7f23a80863f5725c5b94ea34d80e
SHA10b44ea7f301b5736becf544d7833648257fc9801
SHA256c3d0aaba48d5d6576d17bc5e44a88fcb140c83a6a6678323b49bf5a053630e83
SHA5128d0b19ed97bfb8ac1b21057baf32e861fa923c014712902211727972b21e7460109da07a3957a91507bd0df45a3dea751943965d15aa602b532f22b8ae8f4969
-
Filesize
29KB
MD52d38c53e7f7fe2eb1a7cf70096488f39
SHA1679e1eee457e13977df386d9b037c6fe015f20e1
SHA256dea65d5b13786a029d04705cbb44feb06045670b96439f02ea52aa2e1edf1687
SHA5121c2447d7321ac385fde3ef40fd3ce8e38b8d5115dc882a87588e637dce1d0d2731c875e6bf9d9ec3dfa70e4814d9239941a693d2a001bf6f420d48fcb5b7667d
-
Filesize
28KB
MD5e73145ee1e9e39d7bc61023e17776e66
SHA12e12fd4fd44ba9c271f1aa595e92943f9dcae945
SHA2560f1c50387b66f59b09c6c0a706f06c3dbac9deb415c027e3c5718ae4e5ea623b
SHA51273bf6ced51b961ae790c208f6121b3e70ae99ed81a1df0136c5f0d882be29dab91537c6842b29bbc8c8dcfb667ac4417b8206f43aaeb919ad7e432ff143484c2
-
Filesize
26KB
MD5246206a29e47e50a3a49f4141cece4f7
SHA1117f4317c94a882f2f60db15e358fd855b1f89fa
SHA2564a0fc91dc34063f322a30e79561c3cf960cd8af58a2601a1f787b7e1a9e13b97
SHA512d1a7417235e96323f0063c0ebab80213dcf3f4dbb1f8bb89032079126e278a09d0342064ede66827772ff65fed2d352fce79dce3fe58d6ec26e5b0fd2e590098
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
1.6MB
MD557613e500e19529395aa3641fc31249a
SHA1cfe9ce49ea9b8760e73d28c9002d09bbfbfa1f0a
SHA256dffc9f522a7bb30c10ef8bdc6acb27d2d634b97c4d35c6f9e6842ecafd77edef
SHA512b8678275698490d5cc3ad5075e148cf756187f358b5ef6f5c9a8886e3c6b75890065aface25cc87f3513012222be3e33fdc8178d47a1553c0dbed6fc57317986
-
Filesize
895KB
MD51ca102e7cb8545ef3b191e8fd6cb2f43
SHA1a472cd3a9d23f57ff4590d71cb48ae1fc2537d20
SHA256acb772304cdae76230b6806406c160aa9defa61721a04fefc9372d8760021916
SHA5124e7d5f470d654ae472ed4853a0b361ea160717974d125cc419da75ac98d2cdd85b7ac7891dfdc7d7b042dbd67e2679332151a5a21923351ecd6125df0a9a950e