Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe
- Size 4.3MB
- Sample241111-1tt2xaxfnd
- SHA256 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3
- MD5 999a473b01a0a2f39cc87dbc05cd44b8
- SHA1 12976d3e96fcc059021e96f9f56db59de16d6797
- SHA512 bded04ead36e3d49c0f5c82b6ab16f1dd4494d31a14817857da748a082f80a83e19e06d00afc17e206cae57a03d108840bb1b621b0e48c42e813d288172e6635
- SSDEEP 49152:9b9xieuzQq2YhkEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:7xg2YFGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2208 sysx32.exe 1060 _469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Z: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dfrgui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\reg.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe sysx32.exe File created C:\Windows\SysWOW64\systray.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\winver.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe sysx32.exe File created C:\Windows\SysWOW64\tar.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wextract.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe sysx32.exe File created C:\Windows\SysWOW64\mavinject.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\expand.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\find.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe sysx32.exe File created C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\svchost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\userinit.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\autochk.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\certutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\regsvr32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\expand.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe sysx32.exe File created C:\Windows\SysWOW64\PickerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Dism.exe sysx32.exe File created C:\Windows\SysWOW64\proquota.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cscript.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\getmac.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net1.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE sysx32.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Mail\wab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7z.exe sysx32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\updater.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\f\InputSwitchToastHandler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\AuditShD.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\f\wpr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.19041.1_none_8ca9cc4ec3aae4a7\fsutil.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\f\aspnetca.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\r\net1.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\appidcertstorecheck.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\f\recdisc.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\f\EaseOfAccessDialog.exe.tmp sysx32.exe File created C:\Windows\hh.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\r\securekernel.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\autochk.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\ApplyTrustOffline.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmdl32.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.1_none_f92e72a6a03c2c5a\prevhost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\appcmd.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.19041.1_none_00c334ebf83ee740\scrcons.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\r\wmprph.exe sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.19041.1_none_ba3fa9706f28b589\dplaysvr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\f\MuiUnattend.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\r\isoburn.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_ed6c95dcd471837f\r\mmc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\f\PickerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\rstrui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.1_none_29c6c4eed050af59\SyncHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\mofcomp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\wdagtool.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\r\PrintIsolationHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\relog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCE.exe sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\f\CCG.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.19041.1_none_98652fe6e79e6fc9\hdwwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1237_none_9d556cf140e198b4\RecoveryDrive.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\f\spaceman.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.746_none_c2332356a565df1c\dialer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\CameraSettingsUIHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_7ab192ed7079aec0\verifiergui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmscrub.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\r\mstsc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.19041.1_none_e77543382d72effa\findstr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\TiWorker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\windeploy.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.19041.1_none_18b834522b9eb97e\expand.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\f\imecfmui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_1655d5e596a1ade0\netbtugc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\EaseOfAccessDialog.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\MoUsoCoreWorker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\wininit.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.19041.1_none_6c428bc03bd6600a\winver.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\f\nvspinfo.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.264_none_92ee62a6d5b1c18a\fhmanagew.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\f\LanguageComponentsInstallerComHandler.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acsr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.423_none_6c05a0526bbe14de\UserAccountControlSettings.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2208 2996 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe 83 PID 2996 wrote to memory of 2208 2996 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe 83 PID 2996 wrote to memory of 2208 2996 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe 83 PID 2996 wrote to memory of 1060 2996 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe 84 PID 2996 wrote to memory of 1060 2996 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe"C:\Users\Admin\AppData\Local\Temp\469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\_469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exeC:\Users\Admin\AppData\Local\Temp\_469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe2⤵
- Executes dropped EXE
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.3MB
- SHA256 7b9e24f846e044f82849301a5638f6b36ece563083b4e23799f2e61f84deb9ec
- MD5 6e93653e09e01bafc211aff0ba28859b
- SHA1 e4fb62421582a7ef483546fc70c554e0881c29e1
- SHA512 b4b658a2b884c41d14412f669007e6fdf6d10d30b0feaf3246b9032ef81d5bba15a455abaed38b4f560864851b1d6000f5b88378adf38a0bc8d8039ae73c38e6
- SSDEEP 49152:9mgkEaSrEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:gmaLGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3.exe
- Size 4.2MB
- SHA256 8f855a32aafc2095b29c2a4dd8ca62f3dabe8e1a3e3d7ce2b18643085a33a0ee
- MD5 f062fb92b294a0ac7649deda919d860d
- SHA1 2a412b71a02df52c47e08b6b2fd27371ca51b46f
- SHA512 3c28953064c302d941448e5006c0586234b16d19f43eb647c5da223ad21d616b1e4c677824e54983bf45a4abdf932cd857613e0096f3c70ffdbdf6cf37b8f201
- SSDEEP 49152:k9xieuzQq2YhkEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:Qxg2YFGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.3MB
- SHA256 469870bcbc6c92b7bfee9b747e1a8d35bb44a678c9140e351631bbdc2d1648e3
- MD5 999a473b01a0a2f39cc87dbc05cd44b8
- SHA1 12976d3e96fcc059021e96f9f56db59de16d6797
- SHA512 bded04ead36e3d49c0f5c82b6ab16f1dd4494d31a14817857da748a082f80a83e19e06d00afc17e206cae57a03d108840bb1b621b0e48c42e813d288172e6635
- SSDEEP 49152:9b9xieuzQq2YhkEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:7xg2YFGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP