Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe
- Size 9.5MB
- Sample241111-2rhrja1rfp
- SHA256 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac
- MD5 b726964978f4696d9dae3da6352021c6
- SHA1 6e094b8dd4e0c6987d610f5c6a3bd49bcdb76726
- SHA512 846770fc155dcd32e5fff0c27c51d65e9ae51a8cd51c412d7709000924eb88a906fbe311c3ef97be7617c8ee0505bfc18e114c06ccb740cee80d51e77f95f186
- SSDEEP 196608:Ov5RNoZujZZFpEgBDOZRHNrZ0WwPYwKmFSNse257H5jMe/NAWgd/i7D4/mO4y/i8:2oYOZzrJaSNsjMWgd/i7C/iHh4Wx
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1012 sysx32.exe 1000 _5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\iscsicpl.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\powercfg.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\regedt32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\resmon.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe sysx32.exe File created C:\Windows\SysWOW64\logman.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PING.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe sysx32.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\odbcad32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runonce.exe sysx32.exe File created C:\Windows\SysWOW64\doskey.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fontview.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fontview.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe sysx32.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\auditpol.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\charmap.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\autochk.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\instnm.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\prevhost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\eventcreate.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PING.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\ReAgentc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\sc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\help.exe sysx32.exe File created C:\Windows\SysWOW64\TSTheme.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PresentationHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SyncHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\tzutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cttune.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Dism.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PATHPING.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\find.exe sysx32.exe File created C:\Windows\SysWOW64\SearchIndexer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netsh.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Uninstall.exe.tmp sysx32.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe.tmp sysx32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe sysx32.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.tmp sysx32.exe File created C:\Program Files\Windows Mail\wab.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe sysx32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\ntoskrnl.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\sessionmsg.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\r\SettingSyncHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAgentPolicyGenerator.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\wmpnetwk.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\f\CertEnrollCtrl.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5643c883846b0513\aspnet_wp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\FXSCOVER.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1_none_d2cf62416598c002\SIHClient.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\f\SecurityHealthService.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_61ef8d34a0953a91\WMIC.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\f\nvspinfo.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchIndexer.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\f\wermgr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_d9afbb23e990d44a\aspnet_compiler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\r\ClipUp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\r\dmcertinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\f\OOBENetworkConnectionFlow.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\icsunattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\query.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSSVC.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.19041.1_none_0b147d237ce650c5\forfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\wdagtool.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\f\wevtutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1_none_77365f2eaca89f2a\DeviceEnroller.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\rmttpmvscmgrsvr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\r\SystemSettingsAdminFlows.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\wscript.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.19041.1_none_d25dd411ed85e6ba\ksetup.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\icsunattend.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1573dfb37c7563ca\write.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\f\WmsSessionAgent.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\f\SpeechModelDownload.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\f\cmd.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_f28c973357fcbd08\IMEWDBLD.EXE.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\r\dxgiadaptercache.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\EaseOfAccessDialog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_a37f8905d149f29b\PackagedCWALauncher.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\f\Utilman.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\CheckNetIsolation.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAppMonitor.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\r\UsoClient.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c9c647e748814b31\WsatConfig.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\usocoreworker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\r\wifitask.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\r\dstokenclean.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_fce141858c5d7f03\IMEWDBLD.EXE.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVShNotify.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmimageworker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\r\dxgiadaptercache.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.19041.1_none_0e6389fff73df783\expand.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\wmprph.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.19041.1_none_9ed23f0cea1bf54e\DeviceEject.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_60f873a5caaf6704\WinMgmt.exe sysx32.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.1_none_31d99128a3ae3145\WmsSelfHealingSvc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\d0f48d4536e5d701029b00001815341f.InetMgr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\r\Magnify.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1012 2940 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe 84 PID 2940 wrote to memory of 1012 2940 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe 84 PID 2940 wrote to memory of 1012 2940 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe 84 PID 2940 wrote to memory of 1000 2940 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe 85 PID 2940 wrote to memory of 1000 2940 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe"C:\Users\Admin\AppData\Local\Temp\5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1012
-
-
C:\Users\Admin\AppData\Local\Temp\_5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exeC:\Users\Admin\AppData\Local\Temp\_5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe2⤵
- Executes dropped EXE
PID:1000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 9.5MB
- SHA256 2df1cfa28247e6ad2d1609760405e77c4cbf8273c76a6c6ba26be3afba00464d
- MD5 f6dc63bec9eb1e110d9a52b8e7fe574e
- SHA1 9cd06acad38b467404864497557541305f0b8a38
- SHA512 bb854c836e15a0e5077a3281a9cc0c7f9f67c3901b95ea35b606ff4f6232b3e5f5ff06b027c2574236ac900467936eb36226470648a2c7ac47fd011efbfb0c27
- SSDEEP 196608:PazRNoZujZZFpEgBDOZRHNrZ0WwPYwKmFSNse257H5jMe/NAWgd/i7D4/mO4y/i8:PajoYOZzrJaSNsjMWgd/i7C/iHh4Wx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac.exe
- Size 9.5MB
- SHA256 9e3e803e121b88ba5b3d262cfe592f709748b68a440c4a712a2016adfca0b761
- MD5 6ba5cc6a9d54da6adb81641071bfacc9
- SHA1 6c3e6c0344525a7bc2fc19ffa2bc99abfa2c439b
- SHA512 9e36829fe52dc2376def7060f9f6188fa3418fa0f43a90ce51862ff00aaf43d3ca7be8915233e78eccc02f7a3f531d547906852bed7e161ceead44010a092871
- SSDEEP 196608:tv5RNoZujZZFpEgBDOZRHNrZ0WwPYwKmFSNse257H5jMe/NAWgd/i7D4/mO4y/i8:7oYOZzrJaSNsjMWgd/i7C/iHh4Wx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 9.5MB
- SHA256 5de57986b41644f886e848b767e334f9bcd609412cfc2dc23532cf9f18d9f7ac
- MD5 b726964978f4696d9dae3da6352021c6
- SHA1 6e094b8dd4e0c6987d610f5c6a3bd49bcdb76726
- SHA512 846770fc155dcd32e5fff0c27c51d65e9ae51a8cd51c412d7709000924eb88a906fbe311c3ef97be7617c8ee0505bfc18e114c06ccb740cee80d51e77f95f186
- SSDEEP 196608:Ov5RNoZujZZFpEgBDOZRHNrZ0WwPYwKmFSNse257H5jMe/NAWgd/i7D4/mO4y/i8:2oYOZzrJaSNsjMWgd/i7C/iHh4Wx
- MD5 SHA1 SHA512 SSDEEP