Analysis
- max time kernel
138s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 19:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
- Size 4.5MB
- Sample241018-x14m5stfph
- SHA256 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910
- MD5 dc5dae0275966f2e0388d6e23958967d
- SHA1 f1f820befd6706a04fc51fe83c499060cdf4e2f9
- SHA512 4320172667bddfcc686ad5ec9bd72e3ec8faffce12212814fe219b4a97f0a00b145b4405489ee625abdff501ebdbf2e9ac629c62dcc2d0253d72807cc990c7ab
- SSDEEP 98304:X84Vz2lXBj3ukH3sNq8YPgggJGLC1XxvVRA:s4E/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 112 sysx32.exe 5084 _1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\H: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\quickassist.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\LaunchTM.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SyncHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\winrshost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe sysx32.exe File created C:\Windows\SysWOW64\iscsicli.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\powercfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe sysx32.exe File created C:\Windows\SysWOW64\cttune.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\rasdial.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mmc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\printui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\recover.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\certreq.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dllhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe sysx32.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\efsui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSaUacHelper.exe sysx32.exe File created C:\Windows\SysWOW64\fsquirt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ktmutil.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\psr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\systray.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\OpenWith.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ipconfig.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\runas.exe sysx32.exe File created C:\Windows\SysWOW64\colorcpl.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dpapimig.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ndadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp sysx32.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe sysx32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe sysx32.exe File created C:\Program Files\Windows Media Player\setup_wm.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe sysx32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe.tmp sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp sysx32.exe File created C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\f\TrustedInstaller.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\r\SpatialAudioLicenseSrv.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\r\ThumbnailExtractionHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\IEChooser.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\r\pcaui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.1_none_149ab09bad09f1c1\Dism.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\WindowsActionDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.19041.1202_none_fd57358454385601\CustomShellHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseIR.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\f\cleanmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\f\EoAExperiences.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\iexpress.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.19041.1_none_7a6e62f3d1012ed4\vssadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\Dism.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\bootim.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\SnippingTool.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpconfig.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acregl.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\r\pacjsworker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454_memtest.exe_01d80391 sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\ntprint.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\r\WmiPrvSE.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\r\SgrmBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_bb535abd48713dff\wecutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_60c397ff12ee4db1\w3wp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\n\ScreenClipping\ScreenClippingHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\f\DTUHandler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1_none_40c3733167c0c0bd\wpnpinst.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_76011176d90c065b\svchost.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.19041.1_none_5b736f76bce3fff9\msdt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\lodctr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\f\WerFault.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\windeploy.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.844_none_3ca0ef366c7d7a84\Dism.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\f\slui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\mofcomp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\r\CertEnrollCtrl.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.SyncController.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\r\AtBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\f\wermgr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\r\SppExtComObj.Exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\r\logagent.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\vmwp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\r\psr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\ApplySettingsTemplateCatalog.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.1_none_683b3c51d469e51b\LicenseManagerShellext.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\f\smartscreen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSampleUploader.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\wmprph.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1084 wrote to memory of 112 1084 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 84 PID 1084 wrote to memory of 112 1084 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 84 PID 1084 wrote to memory of 112 1084 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 84 PID 1084 wrote to memory of 5084 1084 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 85 PID 1084 wrote to memory of 5084 1084 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe"C:\Users\Admin\AppData\Local\Temp\1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:112
-
-
C:\Users\Admin\AppData\Local\Temp\_1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exeC:\Users\Admin\AppData\Local\Temp\_1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe2⤵
- Executes dropped EXE
PID:5084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.5MB
- SHA256 7a0e3726ce77e659f934d1a3624c50230751966fcc751744619ba8ce13c45af1
- MD5 47379b3a388921ec0429b6581f66e3f2
- SHA1 77b5625f64bf84d95e7fffa3642d2005389c2a1b
- SHA512 eeb220e7759068658883ae245782464714e26e76cb6cd3fc9622e6f15a621d2c03dda48f6fbdb18585d5e5a36f7638d1b456fac41d9fd1de3277837a7db97630
- SSDEEP 98304:gmaVlXBj3ukH3sNq8YPgggJGLC1XxvVRA:PaV/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
- Size 4.4MB
- SHA256 d48bc14a6e59db1ca3b1d1366eeaee66af9bfaf0e808f39fba5276a6bbe61b39
- MD5 7dfc5fc78f76a4887710b55cfc24f5cd
- SHA1 4de66fe40d2c5d983548f285d719a3908d17e706
- SHA512 6aa9daaceff80e227a195838c2ee730ff68b8b089ee742b7714a980079d4c6771abd6ffc86c0b4e13adc2e9910013f005bff246a8fae573891555d4d5465507e
- SSDEEP 98304:U84Vz2lXBj3ukH3sNq8YPgggJGLC1XxvVRA:n4E/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.5MB
- SHA256 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910
- MD5 dc5dae0275966f2e0388d6e23958967d
- SHA1 f1f820befd6706a04fc51fe83c499060cdf4e2f9
- SHA512 4320172667bddfcc686ad5ec9bd72e3ec8faffce12212814fe219b4a97f0a00b145b4405489ee625abdff501ebdbf2e9ac629c62dcc2d0253d72807cc990c7ab
- SSDEEP 98304:X84Vz2lXBj3ukH3sNq8YPgggJGLC1XxvVRA:s4E/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP