gh0strat | 90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 11 IoCs

pid	Process
220	R.exe
4380	N.exe
4676	TXPlatfor.exe
4896	TXPlatfor.exe
3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
2572	Synaptics.exe
5752	Synaptics.exe
5404	._cache_Synaptics.exe
1868	._cache_Synaptics.exe
2100	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
220	R.exe
4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
5404	._cache_Synaptics.exe
1868	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240619531.txt	R.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5404 set thread context of 2932	5404	._cache_Synaptics.exe	114
PID 1868 set thread context of 4344	1868	._cache_Synaptics.exe	115

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4380-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4380-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4380-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4380-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4676-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4676-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4896-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4896-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4676-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4676-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4676-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4896-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/files/0x000c0000000242c2-58.dat	upx
behavioral1/memory/4516-124-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-313-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/4516-388-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/5404-391-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-394-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-393-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-403-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-407-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-413-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-417-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-425-0x0000000000400000-0x00000000008C3000-memory.dmp	upx
behavioral1/memory/1868-446-0x0000000000400000-0x00000000008C3000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\svchost.exe	svchost.exe
File created	C:\Windows\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2952	220	WerFault.exe	85
5468	220	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4788	cmd.exe
5760	PING.EXE

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5760	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3824	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	._cache_Synaptics.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4896	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4380	N.exe
Token: SeLoadDriverPrivilege	4896	TXPlatfor.exe
Token: 33	4896	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4896	TXPlatfor.exe
Token: 33	4896	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4896	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
5404	._cache_Synaptics.exe
5404	._cache_Synaptics.exe
1868	._cache_Synaptics.exe
1868	._cache_Synaptics.exe
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE
3824	EXCEL.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 220	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	85
PID 5136 wrote to memory of 220	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	85
PID 5136 wrote to memory of 220	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	85
PID 5136 wrote to memory of 4380	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	94
PID 5136 wrote to memory of 4380	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	94
PID 5136 wrote to memory of 4380	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	94
PID 4380 wrote to memory of 4788	4380	N.exe	96
PID 4380 wrote to memory of 4788	4380	N.exe	96
PID 4380 wrote to memory of 4788	4380	N.exe	96
PID 4676 wrote to memory of 4896	4676	TXPlatfor.exe	97
PID 4676 wrote to memory of 4896	4676	TXPlatfor.exe	97
PID 4676 wrote to memory of 4896	4676	TXPlatfor.exe	97
PID 5136 wrote to memory of 3536	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	98
PID 5136 wrote to memory of 3536	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	98
PID 5136 wrote to memory of 3536	5136	90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	98
PID 4788 wrote to memory of 5760	4788	cmd.exe	102
PID 4788 wrote to memory of 5760	4788	cmd.exe	102
PID 4788 wrote to memory of 5760	4788	cmd.exe	102
PID 3536 wrote to memory of 4516	3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	103
PID 3536 wrote to memory of 4516	3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	103
PID 3536 wrote to memory of 4516	3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	103
PID 3536 wrote to memory of 2572	3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	106
PID 3536 wrote to memory of 2572	3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	106
PID 3536 wrote to memory of 2572	3536	HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	106
PID 2164 wrote to memory of 5752	2164	cmd.exe	107
PID 2164 wrote to memory of 5752	2164	cmd.exe	107
PID 2164 wrote to memory of 5752	2164	cmd.exe	107
PID 4516 wrote to memory of 5148	4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	109
PID 4516 wrote to memory of 5148	4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	109
PID 4516 wrote to memory of 5148	4516	._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe	109
PID 2572 wrote to memory of 5404	2572	Synaptics.exe	111
PID 2572 wrote to memory of 5404	2572	Synaptics.exe	111
PID 2572 wrote to memory of 5404	2572	Synaptics.exe	111
PID 5752 wrote to memory of 1868	5752	Synaptics.exe	112
PID 5752 wrote to memory of 1868	5752	Synaptics.exe	112
PID 5752 wrote to memory of 1868	5752	Synaptics.exe	112
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 5404 wrote to memory of 2932	5404	._cache_Synaptics.exe	114
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115
PID 1868 wrote to memory of 4344	1868	._cache_Synaptics.exe	115

C:\Users\Admin\AppData\Local\Temp\90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
"C:\Users\Admin\AppData\Local\Temp\90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 448
    3⤵
    - Program crash
    PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 528
    3⤵
    - Program crash
    PID:5468
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5760
- C:\Users\Admin\AppData\Local\Temp\HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
  C:\Users\Admin\AppData\Local\Temp\HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Users\Admin\AppData\Local\Temp\._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_HD_90aa52caa8c2e9b43bc91a7c166bedcf7740b28cfb289732af3ce51d1a3314bf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:5148
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5404
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        Drops file in Windows directory
        
        PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 220 -ip 220
1⤵
PID:3500

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\ProgramData\Synaptics\Synaptics.exe
  C:\ProgramData\Synaptics\Synaptics.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\SysWOW64\._cache_Synaptics.exe
    "C:\Windows\system32\._cache_Synaptics.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:4344

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3824

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery