Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2024, 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe
- Size 1.2MB
- Sample241019-yhassavdpc
- SHA256 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e
- MD5 303268fffad82a30852107a03ebb38e5
- SHA1 84abcf16df37667312bf2313143aed9c8355e89f
- SHA512 22b981b11686cb62c5612861911da13156c01d0f700539cbbb036a9ea945cc2cf4816d624db2c81271affb2ac7b48be771a7acf034b0e906e8dda677e51da658
- SSDEEP 12288:9jQ2VVJt81gkngqOkWW7JuIWfc1uqEN1/fmfMo8HRZBLH/u0c:9jQi/K1OkWUiNj/3HRZh/u
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 2396 sysx32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Z: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\dplaysvr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\psr.exe sysx32.exe File created C:\Windows\SysWOW64\rasphone.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\findstr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ctfmon.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\icacls.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tar.exe sysx32.exe File created C:\Windows\SysWOW64\setupugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\where.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\driverquery.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\whoami.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Windows.WARP.JITService.exe sysx32.exe File created C:\Windows\SysWOW64\RmClient.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe sysx32.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\hh.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msra.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe sysx32.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe sysx32.exe File created C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE sysx32.exe File created C:\Windows\SysWOW64\unregmp2.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\winrs.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dpapimig.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe sysx32.exe File created C:\Windows\SysWOW64\makecab.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe sysx32.exe File created C:\Windows\SysWOW64\comp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cacls.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe sysx32.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\explorer.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\f\rasautou.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\f\XBox.TCUI.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\Dism.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671_winload.exe_75835076.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\AssignedAccessLockApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\r\dsdbutil.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_0d20194b69a60627\label.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\r\slui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\f\nltest.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\f\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\r\wowreg32.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\f\bfsvc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\Magnify.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\Setup.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15805.0_none_6d5f51303f9aca21\SMSvcHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\unregmp2.exe sysx32.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidpolicyconverter.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\HvsiSettingsWorker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\r\LegacyNetUXHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\typeperf.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\systemreset.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\OfflineScannerShell.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.19041.1_none_07600fc1c7993163\ClipRenew.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_eadb9d8875f59863\dllhost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\r\FilePicker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpresult.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.746_none_c2332356a565df1c\dialer.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\f\imjpuexc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_1939c8a90c4232f6\xwizard.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\r\BioIso.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\f\EASPolicyManagerBrokerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseSampleUploader.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_8f7cfa81649ea7a8\esentutl.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\f\FXSUNATD.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.1_none_4475a86a4f1da227\BackgroundTransferHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.1_none_a987c4762e046692\CertEnrollCtrl.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpupdate.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_b970f5eb6342eadb\dpnsvr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimig.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\wmpnetwk.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\DWWIN.EXE.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchProtocolHost.exe sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.19041.1_none_ba3fa9706f28b589\dplaysvr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.19041.1_none_89e9f21ed63037f6\ADSchemaAnalyzer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\comp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\r\wmprph.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\f\printfilterpipelinesvc.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\rdpclip.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1_none_55c691f63ac916c4\wuapihost.exe sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2396 2356 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe 86 PID 2356 wrote to memory of 2396 2356 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe 86 PID 2356 wrote to memory of 2396 2356 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe"C:\Users\Admin\AppData\Local\Temp\2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.2MB
- SHA256 6fcc2ccb55dc4ec0a5383dc07d5f7a8906eb04f9b2dde01a59f7460883b47f71
- MD5 e472572a2e6456116030b7ef334ba05d
- SHA1 ea0063ba682361a3b88d842810287e66606e1198
- SHA512 f2337b9e881b9e5eddad86496710fc459ea289f4bc86fdc393119e0e2662ca12325f1e70422b370fb1e973ad36401f1f1b813260e21d63c73ac41cd1d48129b7
- SSDEEP 12288:9ja7a3iwbihym2g7XO3LWUQfh4CoX1gkngqOkWW7JuIWfc1uqEN1/fmfMo8HRZBo:9jz+gkE2fh4CoF1OkWUiNj/3HRZh/u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 1.2MB
- SHA256 2dc877abb55093a517b0c30774626d1452a2998320f6a0402636b3e9eb4bd35e
- MD5 303268fffad82a30852107a03ebb38e5
- SHA1 84abcf16df37667312bf2313143aed9c8355e89f
- SHA512 22b981b11686cb62c5612861911da13156c01d0f700539cbbb036a9ea945cc2cf4816d624db2c81271affb2ac7b48be771a7acf034b0e906e8dda677e51da658
- SSDEEP 12288:9jQ2VVJt81gkngqOkWW7JuIWfc1uqEN1/fmfMo8HRZBLH/u0c:9jQi/K1OkWUiNj/3HRZh/u
- MD5 SHA1 SHA512 SSDEEP