d51d41f4956478eb7f16aa2fc2fae2e59a44b45e1ab75213b9129c7d3a5c4cb8

Analysis

user interaction
yes
max time kernel
28s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
idk.rar
Size 2.5MB
Sample260722-ja71zscb66
SHA256 d51d41f4956478eb7f16aa2fc2fae2e59a44b45e1ab75213b9129c7d3a5c4cb8
MD5 c10eb54b05faf94109f2bb3cbb3e759f
SHA1 cd7722343340dc3c4deaf81535d1478e156c0af9
SHA512 93c138948bf3829cd360864ad1b3ba1c5098f4513ce6b14a07429f65c003c8ac50a8cb4d4dfc12892dbfa3006401962445f05d93ab92f69496536b70221dbd5d
SSDEEP 49152:2JV7go2ej1mwSLwWS0iZK1jYVYsFtlukKoHKHHyJtyRYtZpuq1rwY55dmesRy3mz:s08jMdiYYVHhKsKnyJgqu4rwuHmez2z
TLSH
T100C53301E7F110C67B54F7A7AB8B9848915342105861AD3E81DF06F26CEBBE6392F4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4052	Synapse X.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse X.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Synapse X.exe = "11001"	Synapse X.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	7zFM.exe
4348	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4348	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4348	7zFM.exe
Token: 35	4348	7zFM.exe
Token: SeSecurityPrivilege	4348	7zFM.exe
Token: SeSecurityPrivilege	4348	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4348	7zFM.exe
4348	7zFM.exe
4348	7zFM.exe
4348	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4052	Synapse X.exe
4052	Synapse X.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4052	4348	7zFM.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\idk.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\7zOCF081C18\Synapse X.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCF081C18\Synapse X.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synapse X.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCF081C18\Synapse X.exe
Size 88KB
SHA256 842a3ff772f1d68bc0347ce507ed85d4b92ede07b75837550160b36f81137bec
MD5 b49aa6083713cf91a884dd9460090407
SHA1 b77b10d6948d8963508ac49aa82379fa42ef1573
SHA512 8809922f0bfea95f631d406548ca8b271fffca5178054710a515eed14d095d7a32aaf9463f39297d0aa97275208ecb90cd9b520d9c996be95caa883ea2970508
SSDEEP 768:/k+ZGtzPMIbLUQUfrwoQJ+eNM/a2VVDdvoXhPaFdJC5YAlfH0eB+ORj+/nScr:M+ZW/Ub1eea2LvoJ6nCuAlvb+OR0
TLSH
T151933F4177F8C61AF2FA6FB4AD7551E00A72BD46ED34D38E1D81389E29B1B408971B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injection_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\7zOCF081C18\injection_debug.txt
Size 327B
SHA256 7a5b390964190905a5f57331950bf4207effd96a593f02bacb3d61a264469c07
MD5 c8b66784cb40d17cb15fdfc37fe06ac9
SHA1 32015c8dcb43cf577fab165d292618c28ebe32d7
SHA512 0fb9a0f55bd7e269a358c3a35cfc44980572eef51c01ea839aecf61b8e1ffb8efd62446912e85c3bdb29d5282f0affe578cb51dc44dd64ab4aa56d298d2672a7
TLSH
T18BE0C2859BBCCC6C4072F65E6D34B9CED1BB87587B4BE918B39A40661701029654C278
MD5 SHA1 SHA512 TLSH

Submit Download

injection_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\7zOCF081C18\injection_debug.txt
Size 4KB
SHA256 5dbeda74163c5a663603452191d069397c741e103d2993b45e23c907f5827edf
MD5 04193f201655319555807216f7927e24
SHA1 206cc0d2211ca1e7ec70c79a6002fd5f3c9d6d81
SHA512 da16f809ec474f3fb5fdb9b2b8115fd8c146c405fd5f4325dbfc7726d779de397f233bfe92116139ab2ccb23268e2b66b9ee16e77ce8bf55b943192ff07128ba
SSDEEP 96:w1A5C9uH7FovI9uHoFogb97HTdgbT97Hegbd97HfgbwQ97H7gbwQ97HOgbwY97HR:w1A5C9cFovI9fFogb9HdgbT9Cgbd9rg+
TLSH
T12091C64FDF7D8D5D8073FD1EA9247CEEA67A876C3F0AF9647342486A0306069644D178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4052-12-0x0000000000330000-0x000000000034C000-memory.dmp

Download

memory/4052-13-0x00000000052A0000-0x0000000005844000-memory.dmp

Download

memory/4052-14-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Download

memory/4052-15-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Download

memory/4052-16-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Download

memory/4052-17-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Download

memory/4052-22-0x000000000DAC0000-0x000000000E266000-memory.dmp

Download

memory/4052-23-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Download

memory/4052-24-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Download