Overview
overview
8Static
static
306_Touchpad/Setup.exe
windows10-2004-x64
706_Touchpad/Setup.exe
windows11-ltsc_2024-x64
406_Touchpa...NT.exe
windows10-2004-x64
806_Touchpa...NT.exe
windows11-ltsc_2024-x64
806_Touchpa...OM.dll
windows10-2004-x64
706_Touchpa...OM.dll
windows11-ltsc_2024-x64
706_Touchpa...32.dll
windows10-2004-x64
306_Touchpa...32.dll
windows11-ltsc_2024-x64
306_Touchpa...xt.rtf
windows10-2004-x64
106_Touchpa...xt.rtf
windows11-ltsc_2024-x64
106_Touchpa...rl.dll
windows10-2004-x64
706_Touchpa...rl.dll
windows11-ltsc_2024-x64
706_Touchpa...32.dll
windows10-2004-x64
306_Touchpa...32.dll
windows11-ltsc_2024-x64
306_Touchpa...LL.dll
windows10-2004-x64
306_Touchpa...LL.dll
windows11-ltsc_2024-x64
306_Touchpa...od.exe
windows10-2004-x64
306_Touchpa...od.exe
windows11-ltsc_2024-x64
306_Touchpa...TP.sys
windows10-2004-x64
306_Touchpa...TP.sys
windows11-ltsc_2024-x64
306_Touchpa...PI.dll
windows10-2004-x64
106_Touchpa...PI.dll
windows11-ltsc_2024-x64
106_Touchpa...OM.dll
windows10-2004-x64
706_Touchpa...OM.dll
windows11-ltsc_2024-x64
706_Touchpa...32.dll
windows10-2004-x64
306_Touchpa...32.dll
windows11-ltsc_2024-x64
306_Touchpa...o4.dll
windows10-2004-x64
106_Touchpa...o4.dll
windows11-ltsc_2024-x64
106_Touchpa...pl.dll
windows10-2004-x64
706_Touchpa...pl.dll
windows11-ltsc_2024-x64
706_Touchpa...nh.exe
windows10-2004-x64
106_Touchpa...nh.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06_Touchpad/Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
06_Touchpad/Setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
06_Touchpad/WinWDF/x64/InstNT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
06_Touchpad/WinWDF/x64/InstNT.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
06_Touchpad/WinWDF/x64/SynCOM.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
06_Touchpad/WinWDF/x64/SynCOM.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
06_Touchpad/WinWDF/x64/SynCOM32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
06_Touchpad/WinWDF/x64/SynCOM32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
06_Touchpad/WinWDF/x64/SynCntxt.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
06_Touchpad/WinWDF/x64/SynCntxt.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
06_Touchpad/WinWDF/x64/SynCtrl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
06_Touchpad/WinWDF/x64/SynCtrl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
06_Touchpad/WinWDF/x64/SynCtrl32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
06_Touchpad/WinWDF/x64/SynCtrl32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
06_Touchpad/WinWDF/x64/SynISDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
06_Touchpad/WinWDF/x64/SynISDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
06_Touchpad/WinWDF/x64/SynMood.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
06_Touchpad/WinWDF/x64/SynMood.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
06_Touchpad/WinWDF/x64/SynTP.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
06_Touchpad/WinWDF/x64/SynTP.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
06_Touchpad/WinWDF/x64/SynTPAPI.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
06_Touchpad/WinWDF/x64/SynTPAPI.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
06_Touchpad/WinWDF/x64/SynTPCOM.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
06_Touchpad/WinWDF/x64/SynTPCOM.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
06_Touchpad/WinWDF/x64/SynTPCOM32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
06_Touchpad/WinWDF/x64/SynTPCOM32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
06_Touchpad/WinWDF/x64/SynTPCo4.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
06_Touchpad/WinWDF/x64/SynTPCo4.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
06_Touchpad/WinWDF/x64/SynTPCpl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
06_Touchpad/WinWDF/x64/SynTPCpl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
06_Touchpad/WinWDF/x64/SynTPEnh.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
06_Touchpad/WinWDF/x64/SynTPEnh.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 06_Touchpad/WinWDF/x64/InstNT.exe
- Size 147KB
- Sample261030-phlevadt8p
- SHA256 ad73c1f27591eb9514ef0fd241efb7cd4e751d35568ea40e62ce75cbc8c23bd6
- MD5 d00ca58c99cfd499aff105f041c669c7
- SHA1 51a27928a184a502594f1e513c67ef0d28f0316f
- SHA512 a5374a56f5453edccf34f33e08334b5b3b66df0be279e72b5343a8f9c390528bfbac46765bf28d95dc7c8e87bafcdc0ed494ec30b3754aa645e4d21a05625434
- SSDEEP 3072:SbuyPNyl8bbCeHV3/WUxVWOZPFf+6Yvt7SL2h74eTid:SDNzbPhZ9xMn6l
- TLSH T1A7E32882B2D184F5D0B7D238CCA266519B71BC155735A3CF3360B6592E37BE8AE39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\SET36D5.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\SynTP.sys DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\SET36D5.tmp DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 8 IoCs
pid Process 4996 DrvInst.exe 4996 DrvInst.exe 4996 DrvInst.exe 4996 DrvInst.exe 4996 DrvInst.exe 4996 DrvInst.exe 4996 DrvInst.exe 4996 DrvInst.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SynTPEnh = "%ProgramFiles%\\Synaptics\\SynTP\\SynTPEnh.exe" DrvInst.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{1973eacc-ffdb-f340-b44e-c95aebdbe464}\SynTP.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynTPHelper.exe DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynTPCpl.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2FB2.tmp DrvInst.exe File created C:\Windows\SysWOW64\SET38B4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1973eacc-ffdb-f340-b44e-c95aebdbe464}\SET29C5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F03.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F16.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynThreeFingerFlick.mpg DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\InstNT.exe DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynTPEnh.exe DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynTP.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\synpd.PNF InstNT.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2FA0.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E4C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F27.tmp DrvInst.exe File opened for modification C:\Windows\system32\SynCOM.dll DrvInst.exe File opened for modification C:\Windows\SysWOW64\SET38B4.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\SynCOM.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E5D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E5E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E93.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F03.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F15.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2FA1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynZMetr.exe DrvInst.exe File opened for modification C:\Windows\system32\SET36F6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynPD.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynCOM.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynTwoFingerVHScroll.mpg DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynMomentum.mpg DrvInst.exe File created C:\Windows\system32\SET36E6.tmp DrvInst.exe File created C:\Windows\system32\SET3717.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\SET38C5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2EF2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynTPRes.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynChiralRotate.mpg DrvInst.exe File created C:\Windows\system32\SET36F6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synhid.inf_amd64_baf66da34696757e\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\system32\SynCtrl.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synhid.inf_amd64_baf66da34696757e.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1973eacc-ffdb-f340-b44e-c95aebdbe464} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F28.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F6B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E6F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\Tutorial.exe DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynPivotRotate_ChiralRotate.mpg DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\synpd.PNF DrvInst.exe File opened for modification C:\Windows\system32\SET38D8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1973eacc-ffdb-f340-b44e-c95aebdbe464}\SET29E8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1973eacc-ffdb-f340-b44e-c95aebdbe464}\SynTP.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E3A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F8E.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2FA0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynCtrl.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\SynThreeFingersDown.mpg DrvInst.exe File created C:\Windows\system32\SET38D8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynLinearVHScroll.mpg DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2F8E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynTP.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E3B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SET2E4D.tmp DrvInst.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Synaptics\SynTP\SET3727.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3796.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynMood.exe DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynLinearVHScroll.mpg DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3882.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3893.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET38A4.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37E9.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynChiralRotate.mpg DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynMomentum.mpg DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynTwoFingerVHScroll.mpg DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynPivotRotate_ChiralRotate.mpg DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynTPCpl.dll DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37D7.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET380C.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3850.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET38A4.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3727.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37D8.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET383E.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynChiralVHScroll.mpg DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynThreeFingerFlick.mpg DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37F9.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET383D.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3850.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3860.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3871.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37E9.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynISDLL.dll DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET383E.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynTPHelper.exe DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynZMetr.exe DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37D7.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37FA.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET381D.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3796.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET384F.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3860.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3871.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3881.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37A6.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET384F.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynTPRes.dll DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynCntxt.rtf DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\Tutorial.exe DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET380C.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET383D.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET3893.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37FA.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\InstNT.exe DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET380B.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynTPCOM.dll DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET380B.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynFlick.mpg DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynThreeFingersDown.mpg DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37A6.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37C7.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynTPEnh.exe DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SynUnst.ini DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3881.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET3882.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37D8.tmp DrvInst.exe File opened for modification C:\Program Files\Synaptics\SynTP\SET37F9.tmp DrvInst.exe File created C:\Program Files\Synaptics\SynTP\SET37C7.tmp DrvInst.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SynInst.log InstNT.exe File opened for modification C:\Windows\INF\setupapi.dev.log InstNT.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\setupact.log DrvInst.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\setuperr.log DrvInst.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs InstNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 InstNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID InstNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID InstNT.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs InstNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F418EBA0-6A10-4482-AC2B-2D10C807073A}\VersionIndependentProgID\ = "SynCtrl.SynAPICtrl" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F418EBA0-6A10-4482-AC2B-2D10C807073A}\ToolboxBitmap32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F418EBA0-6A10-4482-AC2B-2D10C807073A}\ToolboxBitmap32\ = "C:\\Windows\\system32\\SynCtrl.dll, 101" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2060435E-AB52-49E1-A2EA-5D31645887CF}\TypeLib\ = "{82D70786-7968-46EA-836D-203AEBCA4481}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynDisplayCtrl.1\CLSID DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206D8F65-689B-40D0-8F07-8D974CD8884B}\Programmable DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206D8F65-689B-40D0-8F07-8D974CD8884B}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206D8F65-689B-40D0-8F07-8D974CD8884B}\ToolboxBitmap32\ = "C:\\Windows\\system32\\SynCtrl.dll, 118" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A833A93-6641-11D3-B5FE-00104B0A87C2}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynDeviceCtrl\CLSID DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2060435E-AB52-49E1-A2EA-5D31645887CF}\Control DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82D70786-7968-46EA-836D-203AEBCA4481}\1.0\FLAGS DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82D70786-7968-46EA-836D-203AEBCA4481}\1.0\HELPDIR DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{093E1E71-478B-43A0-8A02-3E3074B081E0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C66C161-9F39-42E2-A0E8-B0787560F058}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C66C161-9F39-42E2-A0E8-B0787560F058}\TypeLib\ = "{82D70786-7968-46EA-836D-203AEBCA4481}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A833A92-6641-11D3-B5FE-00104B0A87C2}\ProxyStubClsid32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket.1\CLSID\ = "{E0C6335D-27F8-424B-A5C2-561291A902A0}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket\ = "SynPacket Class" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynAPICtrl\CLSID DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a220a2df-406f-4d68-9b62-995669ae0c92}\TypeLib DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206D8F65-689B-40D0-8F07-8D974CD8884B}\Control DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67FE52E0-3DD2-4BBF-9DA2-D795317F6531} DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67FE52E0-3DD2-4BBF-9DA2-D795317F6531} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket\CLSID\ = "{E0C6335D-27F8-424B-A5C2-561291A902A0}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248AFB1A-27C4-4A30-BF45-6544146648BC}\TypeLib\ = "{E2489565-2CE5-4690-9111-76E79A9F6CCD}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynDeviceCtrl\CLSID\ = "{2060435E-AB52-49E1-A2EA-5D31645887CF}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206D8F65-689B-40D0-8F07-8D974CD8884B}\MiscStatus\1 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{093E1E71-478B-43A0-8A02-3E3074B081E0}\TypeLib DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8317C718-98AB-484A-A12F-EDEB48C8B39F} DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8317C718-98AB-484A-A12F-EDEB48C8B39F}\TypeLib DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8317C718-98AB-484A-A12F-EDEB48C8B39F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket.3\ = "SynPacket Class" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket.3\CLSID DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2489565-2CE5-4690-9111-76E79A9F6CCD}\2.0\HELPDIR\ DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2060435E-AB52-49E1-A2EA-5D31645887CF}\Version DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynDisplayCtrl.1\ = "Synaptics Display Control" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{763FF858-421F-4E12-B5A5-C63B9285AF57}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{763FF858-421F-4E12-B5A5-C63B9285AF57}\TypeLib DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{763FF858-421F-4E12-B5A5-C63B9285AF57}\ = "_ISynDisplayCtrlEvents" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket\CurVer\ = "SynCom.SynPacket.3" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0C6335D-27F8-424B-A5C2-561291A902A0}\ToolboxBitmap32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynDisplay.1 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2489565-2CE5-4690-9111-76E79A9F6CCD}\2.0\FLAGS\ = "0" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynAPICtrl.1\CLSID\ = "{F418EBA0-6A10-4482-AC2B-2D10C807073A}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F418EBA0-6A10-4482-AC2B-2D10C807073A}\MiscStatus\1\ = "132497" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{338CF912-683E-438E-9641-76AAD2D62E22} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{338CF912-683E-438E-9641-76AAD2D62E22}\TypeLib\Version = "1.0" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A833A93-6641-11D3-B5FE-00104B0A87C2}\InprocServer32\ThreadingModel = "Apartment" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.PointingDevice.2\ = "SynDevice Class" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCtrl.SynDeviceCtrl.2\CLSID DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2060435E-AB52-49E1-A2EA-5D31645887CF}\ToolboxBitmap32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8317C718-98AB-484A-A12F-EDEB48C8B39F}\ = "ISynDeviceCtrl" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Synaptics.AbsTouchPad\CurVer DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A833A82-6641-11D3-B5FE-00104B0A87C2}\1.0\FLAGS DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F418EBA0-6A10-4482-AC2B-2D10C807073A}\ProgID DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F418EBA0-6A10-4482-AC2B-2D10C807073A}\VersionIndependentProgID DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2060435E-AB52-49E1-A2EA-5D31645887CF}\MiscStatus\1\ = "132497" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C66C161-9F39-42E2-A0E8-B0787560F058}\TypeLib\ = "{82D70786-7968-46EA-836D-203AEBCA4481}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67FE52E0-3DD2-4BBF-9DA2-D795317F6531}\TypeLib\Version = "1.0" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{763FF858-421F-4E12-B5A5-C63B9285AF57}\TypeLib\ = "{82D70786-7968-46EA-836D-203AEBCA4481}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A833A92-6641-11D3-B5FE-00104B0A87C2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynPacket.2\CLSID DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SynCom.SynDisplay.2 DrvInst.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeLoadDriverPrivilege 5176 InstNT.exe Token: SeLoadDriverPrivilege 5176 InstNT.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeRestorePrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe Token: SeLoadDriverPrivilege 4996 DrvInst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64\InstNT.exe"C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64\InstNT.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5176
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a20e407f-eb34-2d41-b497-3d0f276a8db7}\SynHID.inf" "9" "4381c01d3" "0000000000000184" "WinSta0\Default" "0000000000000180" "208" "C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4532
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f5b036d2-bd70-2e46-aac7-7532456f28ed}\SynPD.inf" "9" "4e68ee01b" "0000000000000180" "WinSta0\Default" "0000000000000164" "208" "C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5924
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ACPI\PNP0F13\4&22F5829E&0" "C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\synpd.inf" "oem2.inf:8a38ddfa615ec6da:DEFAULT__0000__PS2_Inst:14.0.3.0:*pnp0f13," "40bba4d9b" "0000000000000184" "f3e3"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4996
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Synaptics\SynTP\SynTPCOM.dll
- Size 117KB
- SHA256 657523b832fd9f4afd5e5eb3e35dc1bf70e29e216efc4627ee1d366771b365d7
- MD5 60fcb65450de86141549b48f8efb16de
- SHA1 fa6d6b4e3b75f65c93a37b6f43694574a97a9470
- SHA512 997c4292d68d2b61a2df5512ca959127f2ddd47d89fd8c54467f07e62cc76b47a159d7a7745318fdf5faed72af1eae61df92e60a24fa32091b220c5d08085cae
- SSDEEP 1536:n5JLgur3p4VCXrMy4OM6hkdEN4N7mMQcASRjnpavs9s0tUIMDPLnj0BdZSNcSmqK:5JBriy4l4keCN7mM9A8LVtUI0PLnIbHX
- TLSH T12BC34A56B29580F5D46B8279C8D24B8AEBB2B8158B7163CF4324A75D2F733D08E3D361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 68KB
- SHA256 1b45bea0c658c951849eda7ba75cdddd3ea36664aa844cb258e1c8b11216794e
- MD5 53895b8ba9ccec5d8bd9426f9fab7a98
- SHA1 32a49115eada75904fc31100f5eeaf496f349e3c
- SHA512 9f136a233f0ec722043305aaadb08b3805730b8d7516e2679ebf4cbce7b4eb26e95a155fb841b7dd6edfc6cbd37686e8f6fbd197282a6e53ed7a6167c378f986
- SSDEEP 1536:pPLasfSWuWe5wPm5y/ju7j62lDDsGk7FdRYn6qmRzPdcstdydbI47j1+EBNnom96:VYzmt
- TLSH T1D763390584D8C649C9B719B26255EE70D63E6A9A770F4EE530EC6300DEC3F153BBA07A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\synhid.inf_amd64_baf66da34696757e.ini
- Size 538B
- SHA256 0de657e2938d8b2a4848c7e657207d3169e0effa1c438770e7f19fc9013a9af1
- MD5 ec8c38a72b257c49608232b869958ba9
- SHA1 3a5a81fb10193a1f06aca4335e29581e636b2a68
- SHA512 94662fc8be11ba626fc80ed34db4c401ae218e580785a1ded6e0cff1ce415d07db90607435d1d9e030c1e1f01d2f80f861c2d11102331682f80d28d89202cc8f
- TLSH T11CF02492D125E5CC5B288A37063E993CDD3AB227485991CC7741D7E0DB3BE549F240C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51.ini
- Size 2KB
- SHA256 14915b6c196411d285f44bec384ce40af3de10355506e3a40890f2fa2099ce11
- MD5 7c1d6d150ccd6153ac31598bf21baadb
- SHA1 953ef7f889264f283d355a72bbad6a4b3b81581a
- SHA512 6423426579b01f177fede3e12bcf9eab8175c3064578ef528c103a573b256262d8ecb5e990031c6e4c1be8a7538118a669e4548bc5a4aadd318a553dc2349a70
- TLSH T18051D9C2E570A9CE9A688676133DAA3DCC7DE13A815C92CCB351C7E4CB2F9552F109C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51.ini
- Size 3KB
- SHA256 4b597e3f340908068a185e19d9e23ff099e9341033e34b025b7c0dfc8491915b
- MD5 6966f12f43b8f191a06b62dd6f2a8ccd
- SHA1 ce42e40cbcbe7ae19aa9c7674516940455ceacd0
- SHA512 565f9ec5ed3f037b5a0d11358f44e410aae24aadddda70cb59fcaf00427b619fb0ed9a1e94732f916b9ea4b286d5933f9de6480bc1df55259930f0804655fee0
- TLSH T19481DB82E5A4A9C95A188632133E9A3DCC7DE17B415C92CCB351DBE9CB3F9652F109C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\synpd.inf_amd64_9ad941b2ac3eba51\synpd.PNF
- Size 623KB
- SHA256 d9df721ad3f971fa872cf4e99196158069c3c59b8b2459be0f9b9d8a9fc42b80
- MD5 939266f6b4a26f39c4c4455459e6cfd9
- SHA1 3df986a698975a0fa742894819f808c6f8899df6
- SHA512 31a4eba247f25492ab748b6bceea68e77c666be8931964e450f1b33cb3a2a4e5671f7093c6d4f256d01cbc2400081c85f44c2c3e1159e815cd739afe590df720
- SSDEEP 3072:LFUa4yfhWCH4c1au5497VQNJ8jqSMLmL3ezTIH16S:LSaDWCl9Lmqa16S
- TLSH T189D46852FFA4C21CF3B2EAFCEFFA444A44257DD50A61870A1141B6BE1971941ACE1B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynPD.inf
- Size 563KB
- SHA256 5dd3660d281676d7bf3ff1cfefc280b2f41c302a38549995eb920d224c1f258a
- MD5 a949e673a6c260c0ab9da53e08702767
- SHA1 3f57aa5a23d78241598d3762d5621cf0b5a075f9
- SHA512 1647e0498905039f6b2b6fba9ab4f58ba984f7e1c0343666c5745ef6f181dea1163f5f4022056830e351e62f49334f05bba637c1082b10e96a21c5ad836aad53
- SSDEEP 1536:f4AgFOcyvLaQ3HvwPrSAzd7aXnco0ChXJ4SR+pS+chvOQceCnPCwNrqHI0ZANxU9:grpqz3DzuGHM37Hu0WtSCHyLGcAeyfb
- TLSH T18BC4155B342116B4CD479746FB8ABC25426CF19590E32D7E62BAE8C02DD6CD70CAFB09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynTP.cat
- Size 22KB
- SHA256 045d0987d73a2592ee43477337197f157f93fa8b61926ee925f01183bd3c7a2d
- MD5 13ef02f534bf398bdbd70b253aa86979
- SHA1 1dc9aa21ff9d3bc947343e07ca3198da2d7d543e
- SHA512 a5eb4ff09e19ef32ce3008c5a89e4c4d1627eefb4b77f00fea9eeffad0b68956c5d09fa7ba8f6cc59d2b1f1a0c4a3adb68b079965bedde4137351baadea756f9
- SSDEEP 384:CeJm99hdAu1OWv1yYS/1t6HuYtJuTjhk4HV8pxyD1QdUur2cjpv+luqF0i8z:jgmR1m22jpv+luqv0
- TLSH T1F7A2656E06ED02A2A15BC8F28FE6E46FF431DE9BE8019A7D20DB37604542750774ED2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\SynTP.sys
- Size 285KB
- SHA256 607779de4382c9342d12894d2b5585917ef05efc84ec7263aa18c1e96ed0011c
- MD5 8f63178d1db81bb79270ae55ecdd8321
- SHA1 3a4a50c6454def1eed9aef2d004ae55943361dd9
- SHA512 e3df6254eee7ae09d1da5920dd3d8577614864a997306e01534297493acc8af28497871509bec435ca44bf5d629869023e49e84510e60c4d574828faba2604e9
- SSDEEP 6144:+MkD0XYDUBNMdU/VKyhFQ+12mDc77a5z/VeHQI:r5X7MdUPjc77a5z/VeHP
- TLSH T179545C8B93B1106BE5A3D17EC693C77AEA71784063644BDB03B046AA6F437E05D7D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{1f259d43-25e2-0d4a-9ea2-fb563971f5e6}\WdfCoInstaller01009.dll
- Size 1.6MB
- SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
- MD5 4da5da193e0e4f86f6f8fd43ef25329a
- SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
- SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
- SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
- TLSH T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SynCOM.dll
- Size 386KB
- SHA256 fbe221305f101b6a39b333367dc1b55640c76dba12ccf0518bb3c08f6d4280a4
- MD5 6d7c4b655b389bc932d64f6c0776f9e7
- SHA1 37145583a528fd48b8e9bc252029a1d803b08ee5
- SHA512 af83eb3a32b83c3307f5360fea4c197eb0dd740bf7aec1a5e6bb37189d11e37fdc3c46e16ecb30d6831216bc59bc46868d2c5330eeb77996b70c8d1bb68178c4
- SSDEEP 12288:qZxvsqPyxyUAIAALin3aCvLoSsTvCaX7nJZ4h9LG5Tb4y:qjvsqPQVA8Lin3aCvLoFTvCaXTJZF5TB
- TLSH T10F846C82F7A548F4D07FE139C9D3478AE6B1340457A16BCB0754879A2E337E1AA3E325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SynCtrl.dll
- Size 255KB
- SHA256 d84da697fd3898b593c02a2fdfaed65189b44d49183d1b053fb8d41189b06922
- MD5 107d20f4a3aa7c1aadb56ce010356420
- SHA1 b1f22a40ac97e48494129897308c638f410f5e34
- SHA512 5b71dee8f27426398b161af177058c5645897cd88eb27d36c17dbac283708ab006d29149c0094937afad058e5e03e4b5e2859685446e25dc2a37a72f0c508038
- SSDEEP 6144:m44/EpCkRlEcSAzycRpKMU0Kbw4f/sKiUNqva:m43p/RmOPUjJNqC
- TLSH T1D8442942B76082B2C56FC139C8974795FF7274526F6267CB22114B3D2E733E1AE3A612
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SynTPCo4.dll
- Size 144KB
- SHA256 057a28370fc03ca3a255ac6b70881550c42008428f095ec5f61b99235dee973a
- MD5 1b2ffc3a1181878e28704b81aaea5311
- SHA1 2b92d78dcc0b2846983f23c4d2ceccbeadc6e54e
- SHA512 8ea00184cc4f3fc05780324b0ed37da9ac1e1caf551adce4ecaa8fd64ce9d6754b34c4f12c07541614b7e3bb23a16dc692adbbd041af28f2ebc97172417f03be
- SSDEEP 3072:0rNV/gZ8MVdjI1cZmJYV+D8W6+YeC4MYtEPAhNEfwNovcALs5q3Vm:CNVJy0jAWyZDEhUW5rH
- TLSH T1B6E35A96B2A250F9D4ABD23CC9D20792E7B1B424872563CB137086261F637E87F7D724
- MD5 SHA1 SHA512 SSDEEP TLSH