Live Active security incident? Get immediate response
MITRE ATT&CK® Malware

S0242: SynAck

SynAck is variant of Trojan ransomware targeting mainly English-speaking users since at least fall 2017. [1] [2]

EnterpriseS0242MalwareObject v1.3 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

SynAck is a Windows Trojan ransomware variant documented by ATT&CK as targeting mainly English-speaking users since at least fall 2017. The business issue is not just malware identification; the mapped behaviors show a ransomware workflow that can profile the host, inspect services, processes, files, registry and language settings, use stealth such as process doppelgänging and obfuscation, modify or clear Windows evidence, and encrypt data for impact.

Executive priority

Treat this as a ransomware readiness validation case for Windows estates. Leaders should ask whether backups, recovery decision-making, endpoint visibility, centralized logging, and incident response playbooks can withstand ransomware that performs discovery and attempts to impair evidence. It is also a useful audit and resilience test: can the organization prove it collects the right Windows telemetry and can recover critical data if endpoint logs are cleared or files are encrypted?

Technical view

SOC and IR teams should validate coverage for the ATT&CK relationships tied to SynAck: service, process, system, user, file/directory, registry, and language discovery; registry modification; Native API usage; obfuscated files or information; process doppelgänging; Windows event log clearing; and data encryption for impact. Because ATT&CK provides no official detection text for this software object, detection should be behavior-led rather than signature-only, with special attention to Windows endpoint sequences that combine discovery, stealth/process manipulation, registry activity, log clearing, and high-volume file modification.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry for discovery utilities and unusual parent/child process chains
  • Registry query and registry modification events
  • Windows Event Log clearing or audit log interruption events
  • File system telemetry showing rapid enumeration, rename, write, or encryption-like modification patterns
  • Service and process enumeration evidence

Detection direction

  • Build detections around behavior chains rather than SynAck name alone, since the object has no official ATT&CK detection guidance.
  • Correlate discovery activity with registry changes, process manipulation indicators, log clearing, and mass file modification to reduce noise.
  • Tune for false positives from legitimate administration, inventory, backup, software deployment, and troubleshooting tools that enumerate services, processes, files, or registry keys.
  • Treat Windows Event Log clearing as high-value context, especially when near ransomware-like file activity or suspicious process execution.
  • Account for sandbox and analysis blind spots because the mapped behaviors include system checks and system language discovery, which can alter malware behavior in test environments.

Mitigation priorities

  • Prioritize resilient, tested backups and recovery procedures for systems where data availability is business-critical.
  • Centralize and protect Windows logs so local log clearing does not remove incident evidence.
  • Restrict unnecessary administrative privileges that enable registry modification and event log clearing.
  • Harden endpoint prevention and monitoring around suspicious process manipulation, obfuscated payloads, and unauthorized registry changes.
  • Use ransomware tabletop and recovery exercises to confirm escalation paths, business impact decisions, and evidence collection responsibilities.
Analyst notes and limits

The supplied ATT&CK relationships make SynAck useful as a ransomware behavior model: discovery-heavy pre-impact activity, stealth/process manipulation, registry interaction, evidence impairment, and data encryption for impact. The SecureList and Kaspersky references support the SynAck ransomware and process doppelgänging context, but local telemetry is required to determine exposure or detection quality.

ATT&CK lists the malware platform as Windows and provides no official detection text, no aliases, no labels, and no object-level tactics. This summary does not assert active exploitation, attribution, prevalence, or guaranteed detection. Control recommendations are defensive priorities inferred from the supplied ATT&CK fields and relationships, not vendor-specific fixes.

Official MITRE ATT&CK definition

SynAck

SynAck is variant of Trojan ransomware targeting mainly English-speaking users since at least fall 2017. [1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

14 rows
Domain ID Name Relationship / procedure
Enterprise T1083 File and Directory Discovery

SynAck checks its directory location in an attempt to avoid launching in a sandbox.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Enterprise T1112 Modify Registry

SynAck can manipulate Registry keys.CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1027 Obfuscated Files or Information

SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Enterprise T1033 System Owner/User Discovery

SynAck gathers user names from infected hosts.CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1497.001 System Checks Sub-technique

SynAck checks its directory location in an attempt to avoid launching in a sandbox.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Enterprise T1082 System Information Discovery

SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1055.013 Process Doppelgänging Sub-technique

SynAck abuses NTFS transactions to launch and conceal malicious processes.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Enterprise T1106 Native API

SynAck parses the export tables of system DLLs to locate and call various Windows API functions.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Enterprise T1012 Query Registry

SynAck enumerates Registry keys associated with event logs.CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1486 Data Encrypted for Impact

SynAck encrypts the victims machine followed by asking the victim to pay a ransom. CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1007 System Service Discovery

SynAck enumerates all running services.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Enterprise T1685.005 Clear Windows Event Logs Sub-technique

SynAck clears event logs.CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1614.001 System Language Discovery Sub-technique

SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.CitationSecureList SynAck Doppelgänging May 2018
Enterprise T1057 Process Discovery

SynAck enumerates all running processes.CitationSecureList SynAck Doppelgänging May 2018CitationKaspersky Lab SynAck May 2018
Relationship explorer

All related ATT&CK context

uses · Technique T1083: File and Directory Discovery Enterprise uses · Technique T1112: Modify Registry Enterprise uses · Technique T1027: Obfuscated Files or Information Enterprise uses · Technique T1033: System Owner/User Discovery Enterprise uses · Technique T1497.001: System Checks Enterprise uses · Technique T1082: System Information Discovery Enterprise uses · Technique T1055.013: Process Doppelgänging Enterprise uses · Technique T1106: Native API Enterprise uses · Technique T1012: Query Registry Enterprise uses · Technique T1486: Data Encrypted for Impact Enterprise uses · Technique T1007: System Service Discovery Enterprise uses · Technique T1685.005: Clear Windows Event Logs Enterprise uses · Technique T1614.001: System Language Discovery Enterprise uses · Technique T1057: Process Discovery Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
287a9c134a7dd7a2...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.3 Current bundle 287a9c134a7d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SecureList SynAck Doppelgänging May 2018

    Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.

    Open source URL
  2. [2]
    Kaspersky Lab SynAck May 2018

    Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.

    Open source URL
  3. [3]
    SynAck

    (Citation: SecureList SynAck Doppelgänging May 2018) (Citation: Kaspersky Lab SynAck May 2018)

  4. [4]
    mitre-attack S0242
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use