Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe
- Size 5.4MB
- Sample241112-2b18yasfmp
- SHA256 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5
- MD5 1af8e4901edce2debc7b71db5d82fd1d
- SHA1 706ad129c454211c21b9ec44cf4b847c7014afba
- SHA512 7411fcfb4c4ebb31cd75d79edf0fcc84576b4ee15300c977e0ea32cd9667b5fd06bdb02a4cf38715e3831876ad7667322097f0581d680de6a739203a680c4501
- SSDEEP 49152:9A+dy0ZScIBqBT11s9GY568MNwu4acTC3ZvFXkP5VugzsIY4:O+dy0ZScIBqBT116EHcTeqqIb
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 736 sysx32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fixmapi.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe sysx32.exe File created C:\Windows\SysWOW64\shutdown.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\write.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cacls.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\chkntfs.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe sysx32.exe File created C:\Windows\SysWOW64\find.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe sysx32.exe File created C:\Windows\SysWOW64\mspaint.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe sysx32.exe File created C:\Windows\SysWOW64\bitsadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\newdev.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cmd.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Windows.WARP.JITService.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSaUacHelper.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\AtBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\charmap.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\convert.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\certutil.exe sysx32.exe File created C:\Windows\SysWOW64\ftp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cttunesvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PATHPING.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\control.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Register-CimProvider.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe sysx32.exe File created C:\Windows\SysWOW64\TapiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\calc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\doskey.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\user.exe sysx32.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe sysx32.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe sysx32.exe File opened for modification C:\Program Files\dotnet\dotnet.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe sysx32.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.tmp sysx32.exe File created C:\Program Files\SuspendRemove.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.19041.1_none_993ab95f8a87eead\perfhost.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winresume.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\dfrgui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\edpnotify.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\mspaint.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\wpnpinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\r\iissetup.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_6df323382219b604\PickerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\r\WindowsSandboxClient.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\f\wermgr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\f\gpupdate.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\f\msinfo32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchFilterHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\TapiUnattend.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_e341aee7030e39c4\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.1_none_21244f0b33e2b22d\PerceptionSimulationInput.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_85eec0307bfb088e\WPDShextAutoplay.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a89f46f8bfac0a1e\AppLaunch.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1081_none_ae0369bc9fe47e6c\appidtel.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSUNATD.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\r\services.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.19041.1_none_25e540d4bf7b64b4\PresentationHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.1_none_4a852f698914a2f6\schtasks.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVDllSurrogate.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\r\sysprep.exe sysx32.exe File opened for modification C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.19041.1_none_724c73dbde296e25\AddInUtil.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\adamsync.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_8b53de27def16277\eventcreate.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\f\Narrator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.19041.1_none_db6f0c88fb6e127a\taskkill.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.19041.1_none_5d169326bbc0abdb\upfc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\r\Magnify.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_6698d138e79617d9\dcomcnfg.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.19041.1_none_ad39955b83a3f25f\SystemPropertiesAdvanced.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\smartscreen.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\f\TabTip.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.1_none_b89abd72d09ad54d\Utilman.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.1_none_bd38794249e3d110\LockScreenContentServer.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_edda8130b19d4286\CHXSmartScreen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\PinningConfirmationDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\r\BitLockerWizardElev.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\f\djoin.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\SecurityHealthService.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\f\wermgr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\f\rdpclip.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1266_none_149b57f8509ce672\wuapihost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15805.0_none_eb7ee992c51a9917\Microsoft.Workflow.Compiler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_31431424ec14de3f\RdpSa.exe.tmp sysx32.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\f\AtBroker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.1_none_1a86be89cbd66ed2\bdeunlock.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\smartscreen.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1032 wrote to memory of 736 1032 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe 83 PID 1032 wrote to memory of 736 1032 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe 83 PID 1032 wrote to memory of 736 1032 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe"C:\Users\Admin\AppData\Local\Temp\c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\PushCheckpoint.exe
- Size 5.4MB
- SHA256 e21307ebefca7fa1765fb2c54491606aa8e833694cac1994910434c112df8f10
- MD5 465a99db6ab8d8d4d709247e3755bd27
- SHA1 349c05e65c020871f9772e6b782381d6cb32b844
- SHA512 2da470391575bd26dc94e7ea8944c4f740f37442118dfbb6084f0fa196b958f68cb4c42eb4b4cf0fc338e3ff9d8242e556d782a03a210b621be6fbb7b074205a
- SSDEEP 49152:9PmESqfJ3nft3ZxYy0ZScIBqBT11s9GY568MNwu4acTC3ZvFXkP5VugzsIY4:zPJ3fNZxYy0ZScIBqBT116EHcTeqqIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 5.4MB
- SHA256 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5
- MD5 1af8e4901edce2debc7b71db5d82fd1d
- SHA1 706ad129c454211c21b9ec44cf4b847c7014afba
- SHA512 7411fcfb4c4ebb31cd75d79edf0fcc84576b4ee15300c977e0ea32cd9667b5fd06bdb02a4cf38715e3831876ad7667322097f0581d680de6a739203a680c4501
- SSDEEP 49152:9A+dy0ZScIBqBT11s9GY568MNwu4acTC3ZvFXkP5VugzsIY4:O+dy0ZScIBqBT116EHcTeqqIb
- MD5 SHA1 SHA512 SSDEEP