Analysis
- max time kernel
131s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
23/10/2024, 00:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe
- Size 3.5MB
- Sample241023-aak2sasgrq
- SHA256 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf
- MD5 ad93e20008e2ab2cd9f3b5ac158a8f38
- SHA1 37aa7ad1686e453ee394aaafa4b5d51417593a57
- SHA512 b4836a74caec502bc2e38d50b8988dc9e09464d8860b1c9c73c1d12dde4e8fa6c6911b3e062bd424cac7c819ee6a6ef93af57667441a852fff7eb24df8dcb744
- SSDEEP 49152:9ZWBcFElGvXpGF29UVXkAJ9Xc0vmYSO1dGHp+NDGQUzbpDOfjxAkrL:aBcEGvX0oYDwG0Hpe4zbpaAKL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2708 sysx32.exe 3828 _7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\U: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WWAHost.exe sysx32.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netsh.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe sysx32.exe File created C:\Windows\SysWOW64\OpenWith.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\typeperf.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\systeminfo.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe sysx32.exe File created C:\Windows\SysWOW64\DpiScaling.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\mstsc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ROUTE.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\setup16.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\takeown.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe sysx32.exe File created C:\Windows\SysWOW64\tttracer.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wermgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\whoami.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msra.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tar.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\expand.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netsh.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\recover.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\net1.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runas.exe sysx32.exe File created C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dialer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cliconfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe sysx32.exe File created C:\Windows\SysWOW64\PATHPING.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\compact.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe sysx32.exe File created C:\Windows\SysWOW64\taskkill.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\instnm.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\reg.exe sysx32.exe File created C:\Windows\SysWOW64\sfc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\winrshost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mshta.exe sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe sysx32.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_c6fd1ca194aa5c10\RunLegacyCPLElevated.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\msinfo32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\r\MusNotification.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\LaunchTM.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvix64.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\f\backgroundTaskHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe sysx32.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCE.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchIndexer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\f\IEChooser.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\IcsEntitlementHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\f\IMESEARCH.EXE sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.19041.1_none_67326312c2487423\EduPrintProv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-keygen.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\r\lpremove.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\r\WindowsActionDialog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\MoUsoCoreWorker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\r\SecurityHealthHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1_none_8119ed75508e4ffe\wevtutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\setup_wm.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.19041.1_none_34b3f2eea86afb06\sc.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\appidtel.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\instnm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1_none_1a96c19044750bbf\BdeUISrv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\wmlaunch.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\f\printfilterpipelinesvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\wmlaunch.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\r\rstrui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\r\MdmDiagnosticsTool.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\LocationNotificationWindows.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.19041.1_none_58793261dd0b5f7a\grpconv.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.19041.1_none_24012e8e9dd1d9a9\deploymentcsphelper.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\f\MDMAppInstaller.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UpdateNotificationMgr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\WSManHTTPConfig.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.19041.1_none_09fac50a5fe3aec5\Fondue.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\r\IMESEARCH.EXE.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\r\dstokenclean.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\powershell.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\spoolsv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.1_none_4030851754b3e0fb\schtasks.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\r\spaceman.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\f\rdpclip.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_9556bb9420781f39\sdbinst.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFaultSecure.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\f\CheckNetIsolation.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.1_none_b719750f25d4cc37\AppResolverUX.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\wkspbroker.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\SystemUWPLauncher.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\r\DWWIN.EXE.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\r\wevtutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpconfig.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\f\MsSpellCheckingHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.19041.1_none_cc14df174755d4a1\InspectVhdDialog.exe sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2708 2476 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe 84 PID 2476 wrote to memory of 2708 2476 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe 84 PID 2476 wrote to memory of 2708 2476 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe 84 PID 2476 wrote to memory of 3828 2476 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe 85 PID 2476 wrote to memory of 3828 2476 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe"C:\Users\Admin\AppData\Local\Temp\7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\_7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exeC:\Users\Admin\AppData\Local\Temp\_7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe2⤵
- Executes dropped EXE
PID:3828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 3.5MB
- SHA256 f2eee2d3ce71b94778b4a63e018823ccf5dff98f053524a297e172b9efedfb68
- MD5 078d4e118f0fff26702aa673e0a062c3
- SHA1 b5df3ba7409e453f82c98cf25f36aa940e11eb88
- SHA512 83af2b38b06f6c2908b271f0fc0c6ca2ef7adcbc885f34ee941674c2691a44d411ca1f766b0fdda3a89259f3354977155b679cab289b1415da194fa3746ccb9d
- SSDEEP 49152:9mgkEaSp9UVXkAJ9Xc0vmYSO1dGHp+NDGQUzbpDOfjxAkrL:gmawYDwG0Hpe4zbpaAKL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf.exe
- Size 3.5MB
- SHA256 5cbb9af69cc6189b7ba6c8a99fe3cbb0c5c7f9bece8f18336447ac1a3371d623
- MD5 87835f941120451490bc50a33848e9b0
- SHA1 ead0d05d42142502a3c55bde02ae99bc05001c9e
- SHA512 a9a7795312164574a7dd18d8047deb1be69de50a68048fc7faf1b2de30683946eb462592e1053694e5926bc6dd90a55c104bfddd14409fe559286fbbe4557fb4
- SSDEEP 49152:qWBcFElGvXpGF29UVXkAJ9Xc0vmYSO1dGHp+NDGQUzbpDOfjxAkrL:fBcEGvX0oYDwG0Hpe4zbpaAKL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 3.5MB
- SHA256 7d2b17e7e0ab9d6852fb64f22be5924f4a9183c5e977f5e048b1a630c39233bf
- MD5 ad93e20008e2ab2cd9f3b5ac158a8f38
- SHA1 37aa7ad1686e453ee394aaafa4b5d51417593a57
- SHA512 b4836a74caec502bc2e38d50b8988dc9e09464d8860b1c9c73c1d12dde4e8fa6c6911b3e062bd424cac7c819ee6a6ef93af57667441a852fff7eb24df8dcb744
- SSDEEP 49152:9ZWBcFElGvXpGF29UVXkAJ9Xc0vmYSO1dGHp+NDGQUzbpDOfjxAkrL:aBcEGvX0oYDwG0Hpe4zbpaAKL
- MD5 SHA1 SHA512 SSDEEP