Analysis
- max time kernel
16s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 17:17
Behavioral task
behavioral1
Sample
36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe
- Size 3.5MB
- Sample260530-vt7p4sat21
- SHA256 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa
- MD5 a2658babf2da8419b369800551d54ca5
- SHA1 fe74cd71ac374ff28d356d44531fb80f149bf526
- SHA512 7a9e1dec69deaa4756446bf90b72c7756b7c5a6de5ef88a3c3bffaf6e894d3c8a1dcd2508e2b34dcd45b54705eb64e598f45a61d8cd17cccf84441503f4b4a4b
- SSDEEP 98304:82SVMD83nsmtk2auLCarucCAofFs7H99IfGuhb8fe:0tLD17oPb8fe
- TLSH T17506BF2277C18077C22336308D5BE379E5BABE600E35964767D49F3D2E34582A93936B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240649593.bat" look2.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate = "04/01/14" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (data) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 42004f00430048005300200020002d00200031000000 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate = "04/01/14" ._cache_Synaptics.exe Set value (data) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 42004f00430048005300200020002d00200031000000 ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ._cache_Synaptics.exe - Executes dropped EXE 64 IoCs
pid Process 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe 2920 look2.exe 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2580 Synaptics.exe 5060 Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1644 svchcst.exe - Loads dropped DLL 30 IoCs
pid Process 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe 2920 look2.exe 2768 svchost.exe 1644 svchcst.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe - Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe File opened (read-only) \??\F: ._cache_Synaptics.exe File opened (read-only) \??\F: ._cache_Synaptics.exe - Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName = "Dady super powerful PC" ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer = "DADY" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName = "Dady super powerful PC" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer = "DADY" ._cache_Synaptics.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\240649593.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language look2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName = "Dady super powerful PC" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "DADY" ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate = "04/01/2014" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier = "AT/AT COMPATIBLE" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName = "Dady super powerful PC" ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor ._cache_Synaptics.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion = "rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org" ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "DADY" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier = "AT/AT COMPATIBLE" ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor = "SeaBIOS" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor = "SeaBIOS" ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate = "04/01/2014" ._cache_Synaptics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion = "rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Registration\ProductId = "00331-10000-00001-AA793" ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Registration\ProductId = "00331-10000-00001-AA793" ._cache_Synaptics.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe - Suspicious behavior: AddClipboardFormatListener 10 IoCs
pid Process 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe Token: SeDebugPrivilege 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe Token: SeDebugPrivilege 1140 ._cache_Synaptics.exe Token: SeDebugPrivilege 5084 ._cache_Synaptics.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1520 ._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 1140 ._cache_Synaptics.exe 1140 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 5084 ._cache_Synaptics.exe 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE 2292 EXCEL.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80 PID 2476 wrote to memory of 4848 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 83 PID 4848 wrote to memory of 1520 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 86 PID 4848 wrote to memory of 2580 4848 HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 87 PID 2580 wrote to memory of 1140 2580 Synaptics.exe 89 PID 5060 wrote to memory of 5084 5060 Synaptics.exe 92 PID 2768 wrote to memory of 1644 2768 svchost.exe 94 PID 2476 wrote to memory of 2920 2476 36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe"C:\Users\Admin\AppData\Local\Temp\36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exeC:\Users\Admin\AppData\Local\Temp\HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1140
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:3748
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240649593.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1644
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "svchcst"1⤵PID:2184
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5084
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2292
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:3868
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\._cache_HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe
- Size 1.7MB
- SHA256 2b25112d2ac53d695e1b5885f360711adffe93e4e9e87dc4492478f4d9b710a9
- MD5 9ef56e113c9c47b57c929d4b2215a904
- SHA1 149dabbf665c37a920512e55078b06ecac796c21
- SHA512 33b8c990843509180eb3f85e00e60e23b017498c3311ce5cf4971c233f4421f79150e1364f93d82101ea241ad2693cd2ee5dd96dfea537adb4da7068de9b1a31
- SSDEEP 49152:fyiwc8phQkEa1rucCAoBpFMQy7H0Q59IVdGuhb8f:ELCarucCAofFs7H99IfGuhb8f
- TLSH T1D1858C213781847AC27336318A4EB379F6EAAD708A75464757900F392E74593EA3C72F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\13185E00
- Size 25KB
- SHA256 8a32ccb6e58ffed626b59723517e50f5a55a5c40ea43ce0714a52840ae579c72
- MD5 c4fe771963f7e58538f5a04965830709
- SHA1 3c3d63aff445cc1eef5d3d5f3be10a940223fe0c
- SHA512 36cc50a6bc72973ed48e4f268d0149e3b9338a0c540d9f372cf200818c003384a569f444d2f300ccce43271726d51efb3022eb51384dd741a67a19e349d59eba
- SSDEEP 768:MzHO7pYR+mnmg4o5bE1p3msYiywrfFvztVl:MzH8paAA03m2dhp
- TLSH T1BEC2D001FF19FD87F4778C38AD10E0B5F90A25492116DE931452A9EC6AF26CF179E219
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_36e8af2ca47de7b7ff6f25abf4ecf98e59e4e49ceb659dca7bbb248ab71645aa.exe
- Size 2.5MB
- SHA256 78733c5b9dab612529b7f026e26150f29e439fdfc5f242deb2c16b7c6417c59a
- MD5 510438ea3acd3db2ff2d7ad9685ba066
- SHA1 9fe2a0e7fbb4882fc6618c3b7ad7bd021c61c730
- SHA512 cb80ac8f2259f4640e6918ddaa72918829307cfd532144e1d637d5cbc45498ef2ca7f70e58400feec94419bba338cb86514a2727ce4322f0cc0472c501281424
- SSDEEP 49152:PnsHyjtk2MYC5GDUyiwc8phQkEa1rucCAoBpFMQy7H0Q59IVdGuhb8fe:Pnsmtk2auLCarucCAofFs7H99IfGuhbR
- TLSH T145C59E3277C1847BC13336348D4EA379E5AABE705E35564B27D01F3D2E38582A92876B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
- Size 1.1MB
- SHA256 ab9d271c9a127df12d9f7ff39e3c60494e1297257f358dc9c0a9ddf41aa52441
- MD5 b0dcbb36f01ce14fb751453fb32eddf0
- SHA1 a68a2e65022d7c3565eb01d8ee40e4e97709e1aa
- SHA512 ecfa2a3fb8bdf9742a951beb888da50427aa0afcb3eab0aada5e219807d3c6f71bfb033ec61f88ce9c4f08ad6960dc551b58a2b0ee060cbd0cbe2eee5f8802c7
- SSDEEP 24576:zYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnHyz06:zYREXSVMDi3C
- TLSH T12635BF17BB9284F1CA4515308CA7AB76D6759F500F12CB8793D8FE2E7D32141A63B23A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gCgmxRww.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- TLSH T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\look2.exe
- Size 337KB
- SHA256 86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
- MD5 2f3b6f16e33e28ad75f3fdaef2567807
- SHA1 85e907340faf1edfc9210db85a04abd43d21b741
- SHA512 db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
- SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJOU:8IXwDNmZEvJcscRZzjCI1O5W
- TLSH T1B474BF137FE4C8B6C59351324EE25F7AA1F6FE902E224A4333956F0CDD32691963A316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\240649593.bat
- Size 51KB
- SHA256 bbac147420f08694f195f95a06547ee2490c735cb581c470f99dc06d1abf9c81
- MD5 94fde7071a1d9398d80a26ff9e1e0a23
- SHA1 57e5e818aa6c904ddb51880f3b191e84016c14cd
- SHA512 9da4407a64f5a418e5946c949b84acdcb9e75c0cea01acbcd0c14f4f63b2fe8541b16b80678cbff291d2883e7c6aca62baad5e6616ab9dcb8a73e96b669c1417
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLaJYH5:1dWubF3n9S91BF3fboWJYH5
- TLSH T1CC333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\svchcst.exe
- Size 40KB
- SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
- MD5 22bb5bd901d8b25ac5b41edbb7d5053e
- SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
- SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
- SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
- TLSH T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
- MD5 SHA1 SHA512 SSDEEP TLSH