Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe
- Size 5.4MB
- Sample241112-2dnqmasfpk
- SHA256 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5
- MD5 1af8e4901edce2debc7b71db5d82fd1d
- SHA1 706ad129c454211c21b9ec44cf4b847c7014afba
- SHA512 7411fcfb4c4ebb31cd75d79edf0fcc84576b4ee15300c977e0ea32cd9667b5fd06bdb02a4cf38715e3831876ad7667322097f0581d680de6a739203a680c4501
- SSDEEP 49152:9A+dy0ZScIBqBT11s9GY568MNwu4acTC3ZvFXkP5VugzsIY4:O+dy0ZScIBqBT116EHcTeqqIb
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 1084 sysx32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\L: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wsmprovhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\certreq.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\newdev.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\resmon.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\taskkill.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe sysx32.exe File created C:\Windows\SysWOW64\subst.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\doskey.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Register-CimProvider.exe sysx32.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dfrgui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\poqexec.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\user.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dvdplay.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\svchost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\where.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\edpnotify.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logman.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmd.exe sysx32.exe File created C:\Windows\SysWOW64\setupugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\at.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\certreq.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\iexpress.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\chkdsk.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cttune.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe sysx32.exe File created C:\Windows\SysWOW64\mmgaserver.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\choice.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\takeown.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe sysx32.exe File created C:\Windows\SysWOW64\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe sysx32.exe File created C:\Windows\SysWOW64\psr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe sysx32.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp sysx32.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\quickassist.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\wscript.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_21cb4db26317f32e\netiougc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ROUTE.EXE.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_95938c4a44e792de\ReAgentc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\Win32WebViewHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\dllhost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\MoUsoCoreWorker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\f\winlogon.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\ReAgentc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_fa551ac355d48c7f\fontview.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\r\BitLockerWizardElev.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1_none_7519a674b0a74929\CompatTelRunner.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\r\memtest.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\r\wevtutil.exe sysx32.exe File opened for modification C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.19041.1_none_5170c1bc799e651e\AddInProcess.exe sysx32.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_d4adcbe768a8354a\aspnet_regsql.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\SyncAppvPublishingServer.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\ntprint.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_2fe41983d5cad0a7\DevicePairingWizard.exe sysx32.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\CExecSvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\rundll32.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.19041.1_none_42154eff4d5817bf\easinvoker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_aae8e58aa310aa7d\eventvwr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\nfsadmin.exe sysx32.exe File opened for modification C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.19041.1_none_7dca23f8be8c25d6\InspectVhdDialog6.3.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\f\wevtutil.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\mpnotify.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5fe2df342921db66\ilasm.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.1_none_753cc0191556f0a2\SecurityHealthSystray.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\r\CredDialogHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\tabcal.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_d151c6f3c90b1e0b\RunLegacyCPLElevated.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\f\ProximityUxHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpresult.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_4e633e7ac2500190\mspaint.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\r\LaunchWinApp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8298e4b5b7fd2c26\iexplore.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisrstas.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_3b03b28c788655c6\PrintDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\f\DWWIN.EXE.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\sftp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_d6008c7292c63a76\runonce.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\ThumbnailExtractionHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\f\memtest.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\upnpcont.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\oobeldr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_71d70fbd497cca66\Windows.Media.BackgroundPlayback.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\r\sessionmsg.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_fa6e7f402dbc0227\MSBuild.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\notepad.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\r\cmd.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.19041.1_none_0e40322ba49953c6\cacls.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1084 1500 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe 84 PID 1500 wrote to memory of 1084 1500 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe 84 PID 1500 wrote to memory of 1084 1500 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe"C:\Users\Admin\AppData\Local\Temp\c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 5.4MB
- SHA256 476655dbf4fec3f966e51464a5f956a4fa8e3b04072ed13e847de38b0fb3985d
- MD5 e3905b1efb59151867e05c5f6e9ae9cb
- SHA1 2b46679ac818f209f5c147f8f8f486380ed335c3
- SHA512 9c3f1b12fea3a11ec0794425afbdfe6fff93ca49630df0ad656d6e2b0e79e08fcd25c7bb4c504f18bad25337c9f8200668b165e9e6800612afe434a6e5e2379a
- SSDEEP 49152:9mgkEaS3dy0ZScIBqBT11s9GY568MNwu4acTC3ZvFXkP5VugzsIY4:gmaedy0ZScIBqBT116EHcTeqqIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 5.4MB
- SHA256 c9866c46ff67b1e8df75b1202e48d1fa4a69db91c999bd67b69fa4e5463c0ee5
- MD5 1af8e4901edce2debc7b71db5d82fd1d
- SHA1 706ad129c454211c21b9ec44cf4b847c7014afba
- SHA512 7411fcfb4c4ebb31cd75d79edf0fcc84576b4ee15300c977e0ea32cd9667b5fd06bdb02a4cf38715e3831876ad7667322097f0581d680de6a739203a680c4501
- SSDEEP 49152:9A+dy0ZScIBqBT11s9GY568MNwu4acTC3ZvFXkP5VugzsIY4:O+dy0ZScIBqBT116EHcTeqqIb
- MD5 SHA1 SHA512 SSDEEP