Overview
overview
10Static
static
1094975fe621...cd.exe
windows7-x64
1094975fe621...cd.exe
windows10-2004-x64
1094c020786b...1d.exe
windows7-x64
1094c020786b...1d.exe
windows10-2004-x64
1094c7c87a82...20.exe
windows7-x64
194c7c87a82...20.exe
windows10-2004-x64
194dd618932...a1.exe
windows7-x64
394dd618932...a1.exe
windows10-2004-x64
394e2ada20e...f6.exe
windows7-x64
1094e2ada20e...f6.exe
windows10-2004-x64
7952e0a7f82...33.exe
windows7-x64
7952e0a7f82...33.exe
windows10-2004-x64
7953e99960b...40.exe
windows7-x64
10953e99960b...40.exe
windows10-2004-x64
109576cc7c1d...3f.exe
windows7-x64
109576cc7c1d...3f.exe
windows10-2004-x64
10959c2d37a1...19.exe
windows7-x64
10959c2d37a1...19.exe
windows10-2004-x64
1095cc71e95c...eb.exe
windows7-x64
1095cc71e95c...eb.exe
windows10-2004-x64
1095fc2287fc...2c.exe
windows7-x64
1095fc2287fc...2c.exe
windows10-2004-x64
10960c033d30...04.exe
windows7-x64
1960c033d30...04.exe
windows10-2004-x64
196591b5749...ff.exe
windows7-x64
196591b5749...ff.exe
windows10-2004-x64
19695505ced...e7.exe
windows7-x64
19695505ced...e7.exe
windows10-2004-x64
196959cb142...76.exe
windows7-x64
1096959cb142...76.exe
windows10-2004-x64
1096985d97b0...da.exe
windows7-x64
1096985d97b0...da.exe
windows10-2004-x64
10Analysis
-
max time kernel
125s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:14
Behavioral task
behavioral1
Sample
94975fe621437bc551de379ca5db04f88554915fa00e95a8595116a5e91d35cd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
94975fe621437bc551de379ca5db04f88554915fa00e95a8595116a5e91d35cd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
94c020786bf74ea45e95666a68b1d21d.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
94c020786bf74ea45e95666a68b1d21d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
94c7c87a82c5b86f793f2553cc5a6c20.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
94c7c87a82c5b86f793f2553cc5a6c20.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
94dd6189328a24ea86b9726e0ff01aba18c8b2d13cdd59dcdedf9ae19b9700a1.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
94dd6189328a24ea86b9726e0ff01aba18c8b2d13cdd59dcdedf9ae19b9700a1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
94e2ada20e21670b71abcc87c81ea0f6.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
94e2ada20e21670b71abcc87c81ea0f6.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
952e0a7f82d06cd737223c4fe0c0d133.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
952e0a7f82d06cd737223c4fe0c0d133.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
953e99960b6bb27c1953eb4c62949b32b63482f7f5613bf53ae7751bb9678140.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
953e99960b6bb27c1953eb4c62949b32b63482f7f5613bf53ae7751bb9678140.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
9576cc7c1d016017905b260b127b983f.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
9576cc7c1d016017905b260b127b983f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
959c2d37a1e94337957c5323aab9bf19.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
959c2d37a1e94337957c5323aab9bf19.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
95cc71e95ccf96ee404de6261589d09ec40cc8e5536356806e23b2b8ba21fdeb.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
95cc71e95ccf96ee404de6261589d09ec40cc8e5536356806e23b2b8ba21fdeb.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
95fc2287fc4fea75666b56cfd668d72c.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
95fc2287fc4fea75666b56cfd668d72c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
960c033d3033f9058766fe5f229e94401874404c1df50c73856346dc7141a104.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
960c033d3033f9058766fe5f229e94401874404c1df50c73856346dc7141a104.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
96591b574924a1846cfccfedd4cfd584f84e920dc06b5ce05a581a8a067c79ff.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
96591b574924a1846cfccfedd4cfd584f84e920dc06b5ce05a581a8a067c79ff.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
9695505ced3961f59e27022cd01b53f6a05fd1dc98c77f3f4d4b1c16aa72b8e7.exe
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
9695505ced3961f59e27022cd01b53f6a05fd1dc98c77f3f4d4b1c16aa72b8e7.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral29
Sample
96959cb1423fd801a2e3d718868a3776.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
96959cb1423fd801a2e3d718868a3776.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
96985d97b017d4c59db75bdbab49f82d464e90407987be456b1b0ba7f1b748da.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
96985d97b017d4c59db75bdbab49f82d464e90407987be456b1b0ba7f1b748da.exe
Resource
win10v2004-20250314-en
General
-
Target
95fc2287fc4fea75666b56cfd668d72c.exe
-
Size
9.7MB
-
MD5
95fc2287fc4fea75666b56cfd668d72c
-
SHA1
9de58712ca97a8b052b21f8ce7afa9708b671c2b
-
SHA256
16e39062569dd0ef3936b52c974370c6ef11b58149eae4f9d42b7f1079765091
-
SHA512
96371451474490e42cf2444eee70a1a1be4f0a32888f348e1d3ea004bc71621dce799b1190fd9388d2bde36a5d3c57ad9d79c602a798dad5ec626a161032bf70
-
SSDEEP
196608:2Nsg4AMgAINsg4AMgAFNsg4AMgAINsg4AMgAENsg4AMgAiNsg4AMgAANsg4AMgAu:2Gg4a3Gg4aqGg4ajGg4aDGg4a1Gg4aP9
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1976 powershell.exe 576 powershell.exe 1940 powershell.exe 1416 powershell.exe -
resource behavioral21/files/0x000500000001962b-139.dat behavioral21/files/0x000600000001963b-152.dat -
Executes dropped EXE 4 IoCs
pid Process 2972 ._cache_95fc2287fc4fea75666b56cfd668d72c.exe 2992 Synaptics.exe 1700 Synaptics.exe 2424 ._cache_Synaptics.exe -
Loads dropped DLL 4 IoCs
pid Process 2360 95fc2287fc4fea75666b56cfd668d72c.exe 2360 95fc2287fc4fea75666b56cfd668d72c.exe 1700 Synaptics.exe 1700 Synaptics.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_95fc2287fc4fea75666b56cfd668d72c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_95fc2287fc4fea75666b56cfd668d72c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_95fc2287fc4fea75666b56cfd668d72c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 95fc2287fc4fea75666b56cfd668d72c.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 reallyfreegeoip.org 21 reallyfreegeoip.org 4 checkip.dyndns.org 8 reallyfreegeoip.org 9 reallyfreegeoip.org 12 checkip.dyndns.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2792 set thread context of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2992 set thread context of 1700 2992 Synaptics.exe 46 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95fc2287fc4fea75666b56cfd668d72c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95fc2287fc4fea75666b56cfd668d72c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_95fc2287fc4fea75666b56cfd668d72c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1012 schtasks.exe 780 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2036 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 2792 95fc2287fc4fea75666b56cfd668d72c.exe 576 powershell.exe 1940 powershell.exe 2972 ._cache_95fc2287fc4fea75666b56cfd668d72c.exe 2992 Synaptics.exe 2992 Synaptics.exe 2992 Synaptics.exe 2992 Synaptics.exe 2992 Synaptics.exe 2992 Synaptics.exe 2992 Synaptics.exe 2992 Synaptics.exe 1976 powershell.exe 1416 powershell.exe 2992 Synaptics.exe 2424 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2792 95fc2287fc4fea75666b56cfd668d72c.exe Token: SeDebugPrivilege 576 powershell.exe Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 2972 ._cache_95fc2287fc4fea75666b56cfd668d72c.exe Token: SeDebugPrivilege 2992 Synaptics.exe Token: SeDebugPrivilege 1976 powershell.exe Token: SeDebugPrivilege 1416 powershell.exe Token: SeDebugPrivilege 2424 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2036 EXCEL.EXE -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2792 wrote to memory of 1940 2792 95fc2287fc4fea75666b56cfd668d72c.exe 31 PID 2792 wrote to memory of 1940 2792 95fc2287fc4fea75666b56cfd668d72c.exe 31 PID 2792 wrote to memory of 1940 2792 95fc2287fc4fea75666b56cfd668d72c.exe 31 PID 2792 wrote to memory of 1940 2792 95fc2287fc4fea75666b56cfd668d72c.exe 31 PID 2792 wrote to memory of 576 2792 95fc2287fc4fea75666b56cfd668d72c.exe 33 PID 2792 wrote to memory of 576 2792 95fc2287fc4fea75666b56cfd668d72c.exe 33 PID 2792 wrote to memory of 576 2792 95fc2287fc4fea75666b56cfd668d72c.exe 33 PID 2792 wrote to memory of 576 2792 95fc2287fc4fea75666b56cfd668d72c.exe 33 PID 2792 wrote to memory of 1012 2792 95fc2287fc4fea75666b56cfd668d72c.exe 35 PID 2792 wrote to memory of 1012 2792 95fc2287fc4fea75666b56cfd668d72c.exe 35 PID 2792 wrote to memory of 1012 2792 95fc2287fc4fea75666b56cfd668d72c.exe 35 PID 2792 wrote to memory of 1012 2792 95fc2287fc4fea75666b56cfd668d72c.exe 35 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2792 wrote to memory of 2360 2792 95fc2287fc4fea75666b56cfd668d72c.exe 37 PID 2360 wrote to memory of 2972 2360 95fc2287fc4fea75666b56cfd668d72c.exe 38 PID 2360 wrote to memory of 2972 2360 95fc2287fc4fea75666b56cfd668d72c.exe 38 PID 2360 wrote to memory of 2972 2360 95fc2287fc4fea75666b56cfd668d72c.exe 38 PID 2360 wrote to memory of 2972 2360 95fc2287fc4fea75666b56cfd668d72c.exe 38 PID 2360 wrote to memory of 2992 2360 95fc2287fc4fea75666b56cfd668d72c.exe 39 PID 2360 wrote to memory of 2992 2360 95fc2287fc4fea75666b56cfd668d72c.exe 39 PID 2360 wrote to memory of 2992 2360 95fc2287fc4fea75666b56cfd668d72c.exe 39 PID 2360 wrote to memory of 2992 2360 95fc2287fc4fea75666b56cfd668d72c.exe 39 PID 2992 wrote to memory of 1976 2992 Synaptics.exe 40 PID 2992 wrote to memory of 1976 2992 Synaptics.exe 40 PID 2992 wrote to memory of 1976 2992 Synaptics.exe 40 PID 2992 wrote to memory of 1976 2992 Synaptics.exe 40 PID 2992 wrote to memory of 1416 2992 Synaptics.exe 42 PID 2992 wrote to memory of 1416 2992 Synaptics.exe 42 PID 2992 wrote to memory of 1416 2992 Synaptics.exe 42 PID 2992 wrote to memory of 1416 2992 Synaptics.exe 42 PID 2992 wrote to memory of 780 2992 Synaptics.exe 44 PID 2992 wrote to memory of 780 2992 Synaptics.exe 44 PID 2992 wrote to memory of 780 2992 Synaptics.exe 44 PID 2992 wrote to memory of 780 2992 Synaptics.exe 44 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 2992 wrote to memory of 1700 2992 Synaptics.exe 46 PID 1700 wrote to memory of 2424 1700 Synaptics.exe 47 PID 1700 wrote to memory of 2424 1700 Synaptics.exe 47 PID 1700 wrote to memory of 2424 1700 Synaptics.exe 47 PID 1700 wrote to memory of 2424 1700 Synaptics.exe 47 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE975.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1012
-
-
C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe"C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp621D.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:780
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2424
-
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2036
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD595fc2287fc4fea75666b56cfd668d72c
SHA19de58712ca97a8b052b21f8ce7afa9708b671c2b
SHA25616e39062569dd0ef3936b52c974370c6ef11b58149eae4f9d42b7f1079765091
SHA51296371451474490e42cf2444eee70a1a1be4f0a32888f348e1d3ea004bc71621dce799b1190fd9388d2bde36a5d3c57ad9d79c602a798dad5ec626a161032bf70
-
Filesize
91KB
MD5b45e3c4c10da3da0c69e2f90dc3dfb10
SHA161a36473ced38978793a9af1aea1fc528eebe457
SHA256b6fe518ed8ca7ee32f79bb5dd52ab8250cc595d1aa8daec123cef383c6b0bdb6
SHA51244d0c2e0904702dd22c92004415ef3c821bf63de0fb0cc6d7cca41eab36f32531530dd5fdb48017fc5405c7554ae6387514ef3f4e74eea4b36a14d587742e15b
-
Filesize
20KB
MD541d5934cb33a5be7f2178c2f3b5b465a
SHA12f1ea19a8e2cc27df1c19a92abac68a1eec50ed2
SHA25662e7f494c8cb083fec242164d8e2394ebedacad0d09394676d62e04b17e0d2ed
SHA512c56e832d53152ef68952718c721f80eb136d34c95d4578a406c47fbc4cc306eb33d6b048dbe555ecbea9344eadb9875becc70d3cbe4db509ce0d738d82502a99
-
Filesize
22KB
MD581c6f87ee16af0e9e27099bfb8fb5251
SHA10529e965d84d52e9086f91f2da84ade8cfa0ee03
SHA25631d0a0041ff4fff02ae09df6e49be470a1136e106ef7b125b2e552f2c1f4aa48
SHA5128d46f2bf0887623b876e9618d869468bddb0f1d1f9e1a767245369960c0f2d30d29c5743c91c66c6fcae336831332f80529369d5d68e51eefc579735d89d3f60
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1KB
MD59d72bca34262a2e7fba3de3a03c2e049
SHA1185c80e95fb884d857f3659b480c8c2d082c28a5
SHA256781e99a7459eae1031bf16603bf5ac31b442bdfbcec28521208e9629e3786306
SHA5125bce4ec0b0f2e801b69b88e7b1f03db25437ba36c753f7a5f511ea50b4cbac01c57d0208ad7f60d8741949ff5132ff933cc7ea14b848cf5cc56864c1a2e5ebe7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9RCKI473SXXI885VBDEZ.temp
Filesize7KB
MD5fc99145e5c09b033904822638b68c427
SHA1b5fbdd1243e1fe80c2a750970f85065c88eecf6f
SHA2563e3af8293b04045078f89b57ddb5b95c98e1023843f09dc8ce68e114fe672e7f
SHA512555bafbc1365b69094299f866af2223318d600202fbd0f032564934c96c152605ecd31dc8ceb296205db2026e1b866960b5ac56bdd6363f8ff831a3a5a1840e3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDY599YBRLGXNPN7HKW3.temp
Filesize7KB
MD5d101272db906d80f3b4616620e418571
SHA1113d12276958b74138534b50391c22a2acae376a
SHA2560b04bfed3d96c4dd98c25fa85bc1ef306bd64b2a7578ae438e5835d4e9200331
SHA512aa7752a599bd1437687ea21afeca0d68daaadd4ad5dc2198954e8c05f330b5c52e4366717c135ac9a4e08f16544ede35c010d3b7c81f6f78447a20650fe40c86