Analysis
- max time kernel
144s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 19:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
- Size 4.5MB
- Sample241018-xwcnvstdna
- SHA256 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910
- MD5 dc5dae0275966f2e0388d6e23958967d
- SHA1 f1f820befd6706a04fc51fe83c499060cdf4e2f9
- SHA512 4320172667bddfcc686ad5ec9bd72e3ec8faffce12212814fe219b4a97f0a00b145b4405489ee625abdff501ebdbf2e9ac629c62dcc2d0253d72807cc990c7ab
- SSDEEP 98304:X84Vz2lXBj3ukH3sNq8YPgggJGLC1XxvVRA:s4E/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3648 sysx32.exe 3384 _1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\M: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\icacls.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dxdiag.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\pcaui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ttdinject.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\verifiergui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\proquota.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\regsvr32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mmc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\sfc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe sysx32.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe sysx32.exe File created C:\Windows\SysWOW64\wscadminui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\autoconv.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe sysx32.exe File created C:\Windows\SysWOW64\wowreg32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runas.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\raserver.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\extrac32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msdt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe sysx32.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\reg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\resmon.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\compact.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe sysx32.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\DWWIN.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\wextract.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe sysx32.exe File created C:\Windows\SysWOW64\chkdsk.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\printui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\relog.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\bthudtask.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mmc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp sysx32.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\Install\{1D4B5551-822C-42C0-B673-53AB80587853}\chrome_installer.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp sysx32.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\updater.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\WSReset.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\WSReset.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\logman.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\cmdiag.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\r\control.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.19041.1_none_602068813f9366fe\credwiz.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\fltMC.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_6c93021db54246b0\PasswordOnWakeSettingFlyout.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\GameBarPresenceWriter.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\doskey.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\r\setup_wm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.19041.1_none_6e229ee8c467f101\telnet.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\f\printui.exe sysx32.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\r\tcblaunch.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpupdate.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdge.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\f\ApplicationFrameHost.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\r\NgcIso.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\UpgradeResultsUI.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\usocoreworker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_9fd3a313935e2396\upnpcont.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\ace9914536e5d7010a9b00001815341f.WMSvc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\aspnetca.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\mofcomp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\f\AuthHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.84_none_3e82ed1fe15c67db\rstrui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\IcsEntitlementHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\msinfo32.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_e8a5ac944557b7d6\icacls.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_440e94288def3f95\mspaint.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\phoneactivate.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\f\sppsvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\f\AuthHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_682199f2efbfb806\clip.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1_none_604b329da953cf68\FaceFodUninstaller.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\r\icsunattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a790160b3d9e046c\ilasm.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\f\HvsiSettingsWorker.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\HvsiSettingsWorker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\f\SyncHost.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\IMCCPHR.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\LicenseManagerShellext.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\r\MsSpellCheckingHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\scp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\diskperf.exe sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454_memtest.exe_01d80391 sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\r\mmgaserver.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\f\vmwp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\EDPCleanup.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3736 wrote to memory of 3648 3736 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 84 PID 3736 wrote to memory of 3648 3736 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 84 PID 3736 wrote to memory of 3648 3736 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 84 PID 3736 wrote to memory of 3384 3736 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 85 PID 3736 wrote to memory of 3384 3736 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe"C:\Users\Admin\AppData\Local\Temp\1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3648
-
-
C:\Users\Admin\AppData\Local\Temp\_1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exeC:\Users\Admin\AppData\Local\Temp\_1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe2⤵
- Executes dropped EXE
PID:3384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.5MB
- SHA256 7a0e3726ce77e659f934d1a3624c50230751966fcc751744619ba8ce13c45af1
- MD5 47379b3a388921ec0429b6581f66e3f2
- SHA1 77b5625f64bf84d95e7fffa3642d2005389c2a1b
- SHA512 eeb220e7759068658883ae245782464714e26e76cb6cd3fc9622e6f15a621d2c03dda48f6fbdb18585d5e5a36f7638d1b456fac41d9fd1de3277837a7db97630
- SSDEEP 98304:gmaVlXBj3ukH3sNq8YPgggJGLC1XxvVRA:PaV/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910.exe
- Size 4.4MB
- SHA256 d48bc14a6e59db1ca3b1d1366eeaee66af9bfaf0e808f39fba5276a6bbe61b39
- MD5 7dfc5fc78f76a4887710b55cfc24f5cd
- SHA1 4de66fe40d2c5d983548f285d719a3908d17e706
- SHA512 6aa9daaceff80e227a195838c2ee730ff68b8b089ee742b7714a980079d4c6771abd6ffc86c0b4e13adc2e9910013f005bff246a8fae573891555d4d5465507e
- SSDEEP 98304:U84Vz2lXBj3ukH3sNq8YPgggJGLC1XxvVRA:n4E/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.5MB
- SHA256 1974bec0e5b5978c33142344a83f692ffeed911be61a1a6a025c4b11a8fd1910
- MD5 dc5dae0275966f2e0388d6e23958967d
- SHA1 f1f820befd6706a04fc51fe83c499060cdf4e2f9
- SHA512 4320172667bddfcc686ad5ec9bd72e3ec8faffce12212814fe219b4a97f0a00b145b4405489ee625abdff501ebdbf2e9ac629c62dcc2d0253d72807cc990c7ab
- SSDEEP 98304:X84Vz2lXBj3ukH3sNq8YPgggJGLC1XxvVRA:s4E/es3sNq3PgggrRVRA
- MD5 SHA1 SHA512 SSDEEP