File name:

~$cache1.exe

Full analysis: https://app.any.run/tasks/6f28bd13-9761-45c7-9f59-537e92c84888
Verdict: Malicious activity
Analysis date: April 23, 2024, 18:56:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C5EBB2009E6D31AD0A1960BBE41761BE

SHA1:

E6899CEB595CEE09B2D2F7C480754C81183D8E50

SHA256:

FA26CEF4E6752B35AD25E17CEEA340245AE3011C418392FAF31B5E6261163DEB

SSDEEP:

12288:h3H6yScLnqOl0r5Zu0LMFbtizFJ6rAPvOxrcg0i7u48UVVVVVVVVVVVVVVVVVVF0:h3HzLnqOaNMCFJ6kPvOxrcg0i7uF8s3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ~$cache1.exe (PID: 324)

    • Changes the autorun value in the registry

      • ~$cache1.exe (PID: 324)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ~$cache1.exe (PID: 324)

    • Executable content was dropped or overwritten

      • ~$cache1.exe (PID: 324)

    • Reads the Internet Settings

      • ~$cache1.exe (PID: 324)
      • Synaptics.exe (PID: 2548)

    • Reads security settings of Internet Explorer

      • ~$cache1.exe (PID: 324)
      • Synaptics.exe (PID: 2548)

    • Starts itself from another location

      • ~$cache1.exe (PID: 324)

    • Connects to unusual port

      • Synaptics.exe (PID: 2548)

    • Checks Windows Trust Settings

      • Synaptics.exe (PID: 2548)

    • Reads settings of System Certificates

      • Synaptics.exe (PID: 2548)

  • INFO

    • Checks supported languages

      • ~$cache1.exe (PID: 324)
      • Synaptics.exe (PID: 2548)

    • Reads the computer name

      • ~$cache1.exe (PID: 324)
      • Synaptics.exe (PID: 2548)

    • Creates files in the program directory

      • ~$cache1.exe (PID: 324)
      • Synaptics.exe (PID: 2548)

    • Reads the machine GUID from the registry

      • ~$cache1.exe (PID: 324)
      • Synaptics.exe (PID: 2548)

    • Checks proxy server information

      • Synaptics.exe (PID: 2548)

    • Reads the software policy settings

      • Synaptics.exe (PID: 2548)

    • Creates files or folders in the user directory

      • Synaptics.exe (PID: 2548)

    • Create files in a temporary directory

      • Synaptics.exe (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (95.4)
.exe | Win32 Executable Delphi generic (2)
.dll | Win32 Dynamic Link Library (generic) (0.9)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 131072
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ~$cache1.exe synaptics.exe

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Users\admin\AppData\Local\Temp\~$cache1.exe" C:\Users\admin\AppData\Local\Temp\~$cache1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\~$cache1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2548"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
~$cache1.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
8 171
Read events
8 061
Write events
101
Delete events
9

Modification events

(PID) Process:(324) ~$cache1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(324) ~$cache1.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(324) ~$cache1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(324) ~$cache1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(324) ~$cache1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(324) ~$cache1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2548) Synaptics.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2548) Synaptics.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2548) Synaptics.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2548) Synaptics.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
Executable files
1
Suspicious files
7
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_61300524A66CFBC63A090F2F5CE1CE38der
MD5:7A16EFAE67B92DF9E274916C58BF253E
SHA256:E14BCA3914BACD7441D986F1A5A07E7866B8F2DF84980EE10D917FE4C16DFFCE
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400der
MD5:BEC80592F8C95EDB0035D0B5290B984A
SHA256:FD516E643B1AE681BB1A1EBF855A236D86A9E0324081323E09B713B8B842ED9F
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_61300524A66CFBC63A090F2F5CE1CE38binary
MD5:90D687FB93255E70157ED50B31F16668
SHA256:0DA9F12CFA193BBB85E305B81449F50F26ABA09876F3C9281AA296E93A58F452
2548Synaptics.exeC:\Users\admin\AppData\Local\Temp\s2pUCfv.inihtml
MD5:B57ECCEF82F7734C4A682FC8B03DC4DA
SHA256:B2A015082E72E6E884510A5DC8147C0A7226A630837BCF1FBF43091E7327148C
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:44138FCFB23839ABBA01972B119B853D
SHA256:D6B928B6894A40CF51345ABD901DA53EF014F952CAD1FF6632FF04FD25579CDA
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:9A6A6DBA9D3274FB171C4758A2A8B71E
SHA256:2F13D32326172525751748211BE8D965ADF8D49C773CBF3989C3D719B12AB61A
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:2D45192FFF3153D75F9BE41BBB01631F
SHA256:E7F27F238B77258B3FD45211AC1D6E36792E6E9796F3A0407F788C831BF96CCA
2548Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400binary
MD5:8ADFDE947D3CDD9E8405B0E9B396A42A
SHA256:7AC68FCA05BD5E89DE98FC1D393ECB80B9AB8F05D4EBC468695EFFA7468152AC
324~$cache1.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:C5EBB2009E6D31AD0A1960BBE41761BE
SHA256:FA26CEF4E6752B35AD25E17CEEA340245AE3011C418392FAF31B5E6261163DEB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
12
DNS requests
7
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2548
Synaptics.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
—
—
unknown
2548
Synaptics.exe
GET
—
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
unknown
2548
Synaptics.exe
GET
304
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?30d0cb94c7ad4982
unknown
—
—
unknown
2548
Synaptics.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
2548
Synaptics.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD0crTFWCTVIAm4ZwPnmLpo
unknown
—
—
unknown
2548
Synaptics.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGn%2FFPxp5QgGCTkbqgk4vzU%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0351668c06fee42b
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2548
Synaptics.exe
49.13.77.253:1199
xred.mooo.com
Hetzner Online GmbH
DE
unknown
2548
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
unknown
2548
Synaptics.exe
142.250.186.46:443
docs.google.com
GOOGLE
US
whitelisted
2548
Synaptics.exe
87.248.205.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
2548
Synaptics.exe
142.250.181.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2548
Synaptics.exe
142.250.186.161:443
drive.usercontent.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
xred.mooo.com
  • 49.13.77.253
unknown
freedns.afraid.org
  • 69.42.215.252
whitelisted
docs.google.com
  • 142.250.186.46
shared
ctldl.windowsupdate.com
  • 87.248.205.0
  • 178.79.208.1
whitelisted
ocsp.pki.goog
  • 142.250.181.227
whitelisted
drive.usercontent.google.com
  • 142.250.186.161
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
~$cache1.exe