Overview

overview

8

Static

static

3

06_Touchpad/Setup.exe

windows10-2004-x64

7

06_Touchpad/Setup.exe

windows11-ltsc_2024-x64

4

06_Touchpa...NT.exe

windows10-2004-x64

8

06_Touchpa...NT.exe

windows11-ltsc_2024-x64

8

06_Touchpa...OM.dll

windows10-2004-x64

7

06_Touchpa...OM.dll

windows11-ltsc_2024-x64

7

06_Touchpa...32.dll

windows10-2004-x64

3

06_Touchpa...32.dll

windows11-ltsc_2024-x64

3

06_Touchpa...xt.rtf

windows10-2004-x64

1

06_Touchpa...xt.rtf

windows11-ltsc_2024-x64

1

06_Touchpa...rl.dll

windows10-2004-x64

7

06_Touchpa...rl.dll

windows11-ltsc_2024-x64

7

06_Touchpa...32.dll

windows10-2004-x64

3

06_Touchpa...32.dll

windows11-ltsc_2024-x64

3

06_Touchpa...LL.dll

windows10-2004-x64

3

06_Touchpa...LL.dll

windows11-ltsc_2024-x64

3

06_Touchpa...od.exe

windows10-2004-x64

3

06_Touchpa...od.exe

windows11-ltsc_2024-x64

3

06_Touchpa...TP.sys

windows10-2004-x64

3

06_Touchpa...TP.sys

windows11-ltsc_2024-x64

3

06_Touchpa...PI.dll

windows10-2004-x64

1

06_Touchpa...PI.dll

windows11-ltsc_2024-x64

1

06_Touchpa...OM.dll

windows10-2004-x64

7

06_Touchpa...OM.dll

windows11-ltsc_2024-x64

7

06_Touchpa...32.dll

windows10-2004-x64

3

06_Touchpa...32.dll

windows11-ltsc_2024-x64

3

06_Touchpa...o4.dll

windows10-2004-x64

1

06_Touchpa...o4.dll

windows11-ltsc_2024-x64

1

06_Touchpa...pl.dll

windows10-2004-x64

7

06_Touchpa...pl.dll

windows11-ltsc_2024-x64

7

06_Touchpa...nh.exe

windows10-2004-x64

1

06_Touchpa...nh.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/10/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    06_Touchpad/WinWDF/x64/InstNT.exe
  • Size 147KB
  • Sample261030-phlevadt8p
  • SHA256 ad73c1f27591eb9514ef0fd241efb7cd4e751d35568ea40e62ce75cbc8c23bd6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64\InstNT.exe
    "C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64\InstNT.exe"
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4172
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b10dedab-5449-3e4e-a62e-61c7108c9f98}\SynHID.inf" "9" "4381c01d3" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4916
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynPD.inf" "9" "4e68ee01b" "0000000000000158" "WinSta0\Default" "000000000000014C" "208" "C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1848
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ACPI\PNP0F13\4&22F5829E&0" "C:\Windows\INF\oem4.inf" "oem4.inf:8a38ddfa615ec6da:DEFAULT__0000__PS2_Inst:14.0.3.0:*pnp0f13," "40bba4d9b" "0000000000000158"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SynHID.inf
        • Path C:\Users\Admin\AppData\Local\Temp\{b10dedab-5449-3e4e-a62e-61c7108c9f98}\SynHID.inf
        • Size 9KB
        • SHA256 0ba9a5e2f39f76f1acdb62b37fb953fef507f8402aef95db21da38c04294866b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTP.cat
        • Path C:\Users\Admin\AppData\Local\Temp\{b10dedab-5449-3e4e-a62e-61c7108c9f98}\SynTP.cat
        • Size 22KB
        • SHA256 045d0987d73a2592ee43477337197f157f93fa8b61926ee925f01183bd3c7a2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTP.sys
        • Path C:\Users\Admin\AppData\Local\Temp\{b10dedab-5449-3e4e-a62e-61c7108c9f98}\SynTP.sys
        • Size 285KB
        • SHA256 607779de4382c9342d12894d2b5585917ef05efc84ec7263aa18c1e96ed0011c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WdfCoInstaller01009.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{b10dedab-5449-3e4e-a62e-61c7108c9f98}\WdfCoInstaller01009.dll
        • Size 1.6MB
        • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstNT.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\InstNT.exe
        • Size 147KB
        • SHA256 ad73c1f27591eb9514ef0fd241efb7cd4e751d35568ea40e62ce75cbc8c23bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynCOM.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynCOM.dll
        • Size 386KB
        • SHA256 fbe221305f101b6a39b333367dc1b55640c76dba12ccf0518bb3c08f6d4280a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynCOM32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynCOM32.dll
        • Size 165KB
        • SHA256 0177c6d434c2f765849352b35cd2ea5c4f51b0680609d92dc0e62326164ef678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynChiralRotate.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynChiralRotate.mpg
        • Size 373KB
        • SHA256 48469d43a7438fad4dfb31d70413d29d6a9f89616568501ab9d615fec1a36cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynChiralVHScroll.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynChiralVHScroll.mpg
        • Size 1.5MB
        • SHA256 b06b20b2887238b7bdc677f9935e4aaa70295f33c7ad79b80d8ba8079dfaa8b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynCntxt.rtf
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynCntxt.rtf
        • Size 7.4MB
        • SHA256 6c01123252306b55fcc8806104bb0654c7f51e99ba7760da1f8dab8a10643ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynCtrl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynCtrl.dll
        • Size 255KB
        • SHA256 d84da697fd3898b593c02a2fdfaed65189b44d49183d1b053fb8d41189b06922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynCtrl32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynCtrl32.dll
        • Size 201KB
        • SHA256 947bea44d51f54c5e8c302b44d10a51c461dbf4493036db890efb3c41b70feab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynFlick.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynFlick.mpg
        • Size 720KB
        • SHA256 a19a395fe655ba569e4c924cafbb6a2fc6baa1f68ce6a3d3f88a2c5f9d7bb886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynISDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynISDLL.dll
        • Size 193KB
        • SHA256 f250080070de75cdf6a7d70b218ea820594b750a67282eab262ae6e1e4d30b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynLinearVHScroll.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynLinearVHScroll.mpg
        • Size 907KB
        • SHA256 03338165be818588de6a4f229402bbad855df4a43bfb1e078ed06aa1405efd52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynMomentum.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynMomentum.mpg
        • Size 240KB
        • SHA256 c4ffbc1d6dd0cfc0a922ab347bb2f1e79a7caab7c6b6d42c4e801498d4e563dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynMood.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynMood.exe
        • Size 233KB
        • SHA256 45477c6652836b1ce58871af06ba6450a74f096b90db5a59c0a716f301065be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynPinch.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynPinch.mpg
        • Size 279KB
        • SHA256 c8444308c28f2874996e3acfff7a59d3984fb1da145f36e51586fed021cc59a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynPivotRotate_ChiralRotate.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynPivotRotate_ChiralRotate.mpg
        • Size 1.1MB
        • SHA256 716a662ae69cba7cde18c0f3f58a1d4be7048c4247ea0f08370d874817ba0ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPAPI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPAPI.dll
        • Size 200KB
        • SHA256 199e7d5253ef78c04280d6480d748b04d0ff2bd6a2087088bd69936e26c0c5e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPCOM.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPCOM.dll
        • Size 117KB
        • SHA256 657523b832fd9f4afd5e5eb3e35dc1bf70e29e216efc4627ee1d366771b365d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPCOM32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPCOM32.dll
        • Size 105KB
        • SHA256 d9c970ffd4633770eb8ad8ad6cd53df1337035d334df9872cf756877141d10f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPCo4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPCo4.dll
        • Size 144KB
        • SHA256 057a28370fc03ca3a255ac6b70881550c42008428f095ec5f61b99235dee973a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPCpl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPCpl.dll
        • Size 1.5MB
        • SHA256 494f496834290f80e63e0f5701d887bbde0e2ebc336de626ac5957577e1101d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPEnh.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPEnh.exe
        • Size 1.7MB
        • SHA256 fadd63e22805e23bad3bf13f361641f8af6f08166f8a9317499ee6640383a05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPHelper.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPHelper.exe
        • Size 118KB
        • SHA256 3205e07febac7338415316346c6a331d7fc038c9192a7d076d3d89bbafde02b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTPRes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTPRes.dll
        • Size 7.7MB
        • SHA256 7a9d9dd933bc709e9781a83ed591012ab66e0ce53cca34d6fc583b607d2b0016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynThreeFingerFlick.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynThreeFingerFlick.mpg
        • Size 618KB
        • SHA256 49f8fb284011ceab465eb5600800410aa6d4600bf358eb2f42424f3bb6781207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynThreeFingersDown.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynThreeFingersDown.mpg
        • Size 210KB
        • SHA256 02bafb5ea69bc63b769996d9845c0c18587be30b103014a8e99bb20195857062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynTwoFingerVHScroll.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynTwoFingerVHScroll.mpg
        • Size 728KB
        • SHA256 c9f437c7d9adc63eb31429d9363637680428b764cf75201a342ab5ab63f59e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynUnst.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynUnst.ini
        • Size 563KB
        • SHA256 5dd3660d281676d7bf3ff1cfefc280b2f41c302a38549995eb920d224c1f258a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SynZMetr.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\SynZMetr.exe
        • Size 241KB
        • SHA256 ea6261cf5322e3a0440e5a3fca60d62c73c59025164e8004e36b5c1be8bceb88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Tutorial.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{f1378aec-d337-9a47-8604-7ccc4ad19447}\Tutorial.exe
        • Size 329KB
        • SHA256 a446009c6897a03254dfcfa622b97c7e2745d16224b55552325601059b46783d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 37KB
        • SHA256 613fb1a0b7e1ae6e0924f90ed50925131b18c9412032b55dc64c8d29c59e30ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        synpd.PNF
        • Path C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\synpd.PNF
        • Size 624KB
        • SHA256 318fedf6a5f98f8d4bf72ef21eef5df838bbdadd9193b55a56ffe73539ef0b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1192-832-0x00000000003B0000-0x00000000003F3000-memory.dmp
        Download

        memory/1192-826-0x00000000003B0000-0x0000000000414000-memory.dmp
        Download

        memory/1192-820-0x00000000003B0000-0x00000000003D1000-memory.dmp
        Download