Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe
-
Size
2.2MB
-
MD5
af7918b1f0fa15c1e469e7fe67661284
-
SHA1
49596d23e1272920cf97e7689f245fdaa6a69dd8
-
SHA256
b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe
-
SHA512
fa9614f46c9fd1ea4da9377cc89b2c7c51c11aa5da9668e558d764af1ce722cbdf498a80a072d2424ea96e6614ffc00e3c12ba6fc7c60f775de9cac62f098e8d
-
SSDEEP
49152:9kg1eRGtD8X87zjjF/TU/EDb43VhecXpUlZX3pz:GYectgGPh6xUXX3pz
Score
9/10
Malware Config
Signatures
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 3468 sysx32.exe 3232 _b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\A: sysx32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cleanmgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\gpscript.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\autofmt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\certreq.exe sysx32.exe File created C:\Windows\SysWOW64\subst.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\w32tm.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\runas.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\help.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\curl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\TSTheme.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\instnm.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\relog.exe sysx32.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\makecab.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\newdev.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\write.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\finger.exe sysx32.exe File created C:\Windows\SysWOW64\Fondue.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\makecab.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\setx.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\winrs.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\explorer.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\mobsync.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe sysx32.exe File created C:\Windows\SysWOW64\mavinject.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe sysx32.exe File created C:\Windows\SysWOW64\wiaacmgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\AtBroker.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\DWWIN.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\reg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\setup16.exe sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\instnm.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\msdt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\fontdrvhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe.tmp sysx32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe sysx32.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe.tmp sysx32.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe.tmp sysx32.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp sysx32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\r\msoobe.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\r\BitLockerDeviceEncryption.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\aciniupd.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\r\autofmt.exe sysx32.exe File opened for modification C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_d9afbb23e990d44a\aspnet_compiler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\wermgr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\LegacyNetUXHost.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\r\drvinst.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\r\CredDialogHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\r\dsdbutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\f\Microsoft.AAD.BrokerPlugin.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\r\wksprt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.19041.1_none_4547ebb03c53c11a\DataSvcUtil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\tracerpt.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\f\licensingdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\securekernel.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.19041.1_none_993ab95f8a87eead\perfhost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.19041.1_none_958f624251c93843\MSchedExe.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\mofcomp.exe sysx32.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a60e034236e5d701ed9600001815341f.ShellLauncherConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_5c4f760174b23886\resmon.exe sysx32.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_eddf8132c42e0857\AssignedAccessLockApp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1_none_9a8a77811e17322b\LsaIso.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\sessionmsg.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_623e57cb80e184b5\PasswordOnWakeSettingFlyout.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\dstokenclean.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_e0dec3877978d84a\mscorsvw.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1_none_65637d0d99e451f6\DeviceCensus.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\DiskSnapshot.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.906_none_5f45625010b4cd19\InetMgr6.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1_none_6bb2ce5b63f82957\FsIso.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.19041.1_none_958f624251c93843\MSchedExe.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.19041.1_none_de343fb4f9af2b0a\tasklist.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\f\bcdboot.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\f\fltMC.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\f\hcsdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\r\csrss.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\r\InputSwitchToastHandler.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1_none_f35caf2131abed9a\lsass.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\r\splwow64.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15805.0_none_ae80a3049486a75f\EdmGen.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\r\CheckNetIsolation.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\AtBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UNPUXHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\f\NgcIso.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1_none_f725ad3465e95fe3\klist.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\f\WmsSvc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\LaunchTM.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1_none_6f2c92b5bf3d99bc\Taskmgr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\f\desktopimgdownldr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-secinit_31bf3856ad364e35_10.0.19041.1_none_47fda84da0bc8185\secinit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_ee00310940a3cd37\wordpad.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\notepad.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\upnpcont.exe.tmp sysx32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3100 wrote to memory of 3468 3100 b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe 85 PID 3100 wrote to memory of 3468 3100 b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe 85 PID 3100 wrote to memory of 3468 3100 b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe 85 PID 3100 wrote to memory of 3232 3100 b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe 86 PID 3100 wrote to memory of 3232 3100 b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe 86 PID 3100 wrote to memory of 3232 3100 b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe"C:\Users\Admin\AppData\Local\Temp\b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3468
-
-
C:\Users\Admin\AppData\Local\Temp\_b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exeC:\Users\Admin\AppData\Local\Temp\_b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe2⤵
- Executes dropped EXE
PID:3232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD578c05dce94b0aa96e1e654c4912698c8
SHA1a0cf305c8fdd2ffb37a455c4df608d72e3128833
SHA2563a76a810056e8833fb9236d6c749018439921ab8b10415aeede6e35d9580eae2
SHA512c5b71df37a58a4288f6ba501ff9db457e335a3e89a3221e2cb3632453e4f2afc13592c22370a6d2813b848f0c88cdcb48b1679548db46988883e8cb197ffa863
-
C:\Users\Admin\AppData\Local\Temp\_b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe.exe
Filesize2.2MB
MD537783e16398449f5373964a8a1ce4b8b
SHA1ef5d1c212ee7ea4a117600a2733bcf318dabcaf0
SHA25636f3bb55e71acafa229f3daf7d5db994328a6019d43292c47e832e3122b76704
SHA512fafdcb54701b3d639606f2e3bf6249fdc60a8cd48577029d3635a49a08ed422284b31e3d1307fd2a9eb7baf3960e5c79edb2ef9aba0ec4ab67a0a5550c34f6a3
-
Filesize
2.2MB
MD5af7918b1f0fa15c1e469e7fe67661284
SHA149596d23e1272920cf97e7689f245fdaa6a69dd8
SHA256b9efe854407809986b565e28ee2dea7c0bb681c5f1fa5d5e721103ccaaa5befe
SHA512fa9614f46c9fd1ea4da9377cc89b2c7c51c11aa5da9668e558d764af1ce722cbdf498a80a072d2424ea96e6614ffc00e3c12ba6fc7c60f775de9cac62f098e8d