Analysis
- max time kernel
94s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe
- Size 4.2MB
- Sample241109-3jf4eavbnk
- SHA256 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d
- MD5 1be74ac8bd128623354e5c0ede7d75ae
- SHA1 1fd07b009b9351e62a97af9bbe959186df935fde
- SHA512 e78b4c72ffc414cc63609b1434690ede4633ca001ce632a1ae4824d7b1f60ee84be32f8c8282088d3de0406fb1a87037914293a6fb9f9b657ad6ab31b163bc16
- SSDEEP 49152:9ezBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:EB+o1c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3660 sysx32.exe 664 _754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\Z: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\net.exe sysx32.exe File created C:\Windows\SysWOW64\perfhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\appidtel.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cscript.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\svchost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemUWPLauncher.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe sysx32.exe File created C:\Windows\SysWOW64\autofmt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ttdinject.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe sysx32.exe File created C:\Windows\SysWOW64\verclsid.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\autochk.exe sysx32.exe File created C:\Windows\SysWOW64\dllhst3g.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\OneDriveSetup.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\provlaunch.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\setx.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TokenBrokerCookies.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe sysx32.exe File created C:\Windows\SysWOW64\eventvwr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe sysx32.exe File created C:\Windows\SysWOW64\icacls.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\msdt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\typeperf.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\winver.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\cmstp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\edpnotify.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\verifiergui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PkgMgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe sysx32.exe File created C:\Windows\SysWOW64\sysx32.exe sysx32.exe File created C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\updater.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe sysx32.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe sysx32.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.tmp sysx32.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe sysx32.exe File opened for modification C:\Program Files\dotnet\dotnet.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\relog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\f\ShapeCollector.exe.tmp sysx32.exe File opened for modification C:\Windows\notepad.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\sethc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\f\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-add.exe sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc_winmgmt.exe_8f8eb7b1.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmmon32.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\r\FilePicker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_eae66734659b60d0\wowreg32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\r\sihost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\user.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpshare.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\r\quickassist.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_fa6e7f402dbc0227\MSBuild.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\f\Defrag.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.264_none_911b6d2a51481d59\mavinject.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1_none_36e57bfcb85e0850\SpatialAudioLicenseSrv.exe sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c4e6302d398f7e04\mscorsvw.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_6b761570d2ba1947\certutil.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.906_none_388c7870566ba06d\WMSvc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d_wininit.exe_7a527f28 sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFault.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\audit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\diskperf.exe sysx32.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\r\rrinstaller.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\f\rrinstaller.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\r\dsdbutil.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\browser_broker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\UIMgrBroker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_cc9d1ee374152f46\UserAccountBroker.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_313898283cd914f7\backgroundTaskHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\relog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_f04c7dcfd4283324\AppLaunch.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\f\dmclient.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.153_none_7799fc2afae9a500\f\MDMAppInstaller.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\wscadminui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\r\UtcDecoderHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\f\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\fixmapi.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_20798db5235046f8\provlaunch.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_255cf058436a8b63\gpscript.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_72f9f7c7a1b307dd\TpmTool.exe sysx32.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_41668bdd85c44640\InetMgr6.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\bcdboot.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\audit.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\f\wsqmcons.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\r\ApplicationFrameHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\r\TrustedInstaller.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\r\rundll32.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1076 wrote to memory of 3660 1076 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe 83 PID 1076 wrote to memory of 3660 1076 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe 83 PID 1076 wrote to memory of 3660 1076 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe 83 PID 1076 wrote to memory of 664 1076 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe 85 PID 1076 wrote to memory of 664 1076 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe 85 PID 1076 wrote to memory of 664 1076 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe"C:\Users\Admin\AppData\Local\Temp\754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\_754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exeC:\Users\Admin\AppData\Local\Temp\_754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.2MB
- SHA256 004ebe79e253e251e3b1ec9ed1e5538db6aef598e0f11c785c76911b1809f5dd
- MD5 9bd1cc36f10400c14630fbb9fcc62fd5
- SHA1 557d992a823b4b5cba1ce36277df5117e3e7b86b
- SHA512 d52d6df7540f973abd9d0407f230de11fe0dadd323e574f6f8adc06e8e4402f52a636fbc253225709979fb5183310b18f7060e455767836f97f60b30d4ccdb79
- SSDEEP 49152:9mgkEaSf3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:gma31c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d.exe
- Size 4.2MB
- SHA256 f52001148cbafe7cc25dc775d1f513f93c0b8fb6d768b4d9af2ff37bd30be3fd
- MD5 9c46e0282715ac48e7894868d895f431
- SHA1 c459da18ac6c1ad04e99a213bedefb826594e2df
- SHA512 a7beaf2ccc8a4f96a462071db66d126ae4e8399e82d14a6a77668450afbdc4bdd508c44bb1ff30ba1082044892ec5a8d6ab1d134124d084f21d18054a33f2902
- SSDEEP 49152:hzBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:xB+o1c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.2MB
- SHA256 754afb85abf42f3318756e15b20e71cee4530be385e4f8275ab6dc5ee043191d
- MD5 1be74ac8bd128623354e5c0ede7d75ae
- SHA1 1fd07b009b9351e62a97af9bbe959186df935fde
- SHA512 e78b4c72ffc414cc63609b1434690ede4633ca001ce632a1ae4824d7b1f60ee84be32f8c8282088d3de0406fb1a87037914293a6fb9f9b657ad6ab31b163bc16
- SSDEEP 49152:9ezBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:EB+o1c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP