Analysis
- max time kernel
94s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
- Target 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe
- Size 4.4MB
- Sample241112-e7tgmsyjen
- SHA256 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3
- MD5 f7f68dfe6cca77e0db825121a8aa5940
- SHA1 8918bae90917d490bd2e656d002397c316981b97
- SHA512 4fe81fb812f595cf04b4f464f019d47f1d12ca6ce987308dd653e9a1b5124217e1d43d5735e5e5ce43bfeb424d628bfbe820a1434c089d5847ddecc864daa063
- SSDEEP 12288:9jlN3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bk:9j1+gkE2fh4CoRX5SnW
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe - Executes dropped EXE 2 IoCs
pid Process 2088 sysx32.exe 5008 _5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\E: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\autoconv.exe sysx32.exe File created C:\Windows\SysWOW64\charmap.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\fc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\gpscript.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\tttracer.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wevtutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe sysx32.exe File created C:\Windows\SysWOW64\fontdrvhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe sysx32.exe File created C:\Windows\SysWOW64\relog.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\newdev.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\OpenWith.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\at.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cleanmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\finger.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runas.exe sysx32.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\sysx32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\certreq.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\resmon.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\runonce.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe sysx32.exe File created C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\regsvr32.exe sysx32.exe File created C:\Windows\SysWOW64\replace.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\WWAHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\label.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe sysx32.exe File created C:\Windows\SysWOW64\ftp.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\logagent.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe sysx32.exe File created C:\Windows\SysWOW64\mshta.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\relog.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\clip.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\notepad.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\icsunattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\bthudtask.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\notepad.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe sysx32.exe File created C:\Windows\SysWOW64\reg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\winver.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\whoami.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\Install\{9733680C-0D1E-4BD2-A74F-0CCF42A8BF32}\chrome_installer.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe sysx32.exe File created C:\Program Files\Windows Mail\wab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe sysx32.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{9733680C-0D1E-4BD2-A74F-0CCF42A8BF32}\chrome_installer.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.tmp sysx32.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\BackgroundTransferHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\f\SystemSettingsBroker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\sdclt.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.1_none_16cc981df6cf3111\WmsUserAgent.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_0e4d25c8cb52f8d0\WFServicesReg.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe_nissrv.exe_f967cd63.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\audiodg.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\wowreg32.exe sysx32.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\r\CapturePicker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\f\FXSSVC.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.1_none_31d99128a3ae3145\WmsSelfHealingSvc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\f\omadmclient.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_15d956c7fccae922\runas.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\f\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\f\wevtutil.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\aspnetca.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.1_none_b0876c2e7a0b3a5f\SpaceAgent.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\f\powershell.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\ScriptRunner.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.19041.1_none_afe6484e54f00fd0\compact.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\WorkFolders.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_a64f417ee38bbfd9\hh.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\PerceptionSimulationInput.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_cbabe2205e65787b\runonce.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\EaseOfAccessDialog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\f\MusNotifyIcon.exe sysx32.exe File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_c9f3f831b5b3535d\PinningConfirmationDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\f\wininit.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.1151_none_f7be996d8409bfa1\wsl.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\r\Microsoft.AsyncTextService.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\f\WorkFolders.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\r\fontdrvhost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1_none_a353adcda7cf69e6\convertvhd.exe sysx32.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_5efb81c4b092852b\cvtres.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\BackgroundTransferHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.19041.1_none_5a9698f03a1b8696\repadmin.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_24a9c1e1e1b0f793\tttracer.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\TSWbPrxy.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_6c221eaccd6c91ae\msinfo32.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\r\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_7e723dd43021c2d3\ImagingDevices.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\eshell.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\instnm.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.19041.1_none_827105fe900187d1\wiawow64.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseNdr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_291e1d3069ab2f3a\diskpart.exe sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\dsdbutil.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.19041.1_none_5ca728f7dabaeefb\tlsbln.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.19041.1_none_5d169326bbc0abdb\upfc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_d848cc62b1883bca\r\cttunesvr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasdial.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\r\SyncHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.19041.1_none_4caa24969a02f9c3\timeout.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\r\OOBENetworkCaptivePortal.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.19041.1_none_bf4cc5bb201caae3\powercfg.exe.tmp sysx32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1816 wordpad.exe 1816 wordpad.exe 1816 wordpad.exe 1816 wordpad.exe 1816 wordpad.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2088 2696 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 83 PID 2696 wrote to memory of 2088 2696 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 83 PID 2696 wrote to memory of 2088 2696 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 83 PID 2696 wrote to memory of 5008 2696 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 84 PID 2696 wrote to memory of 5008 2696 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 84 PID 5008 wrote to memory of 1816 5008 _5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 85 PID 5008 wrote to memory of 1816 5008 _5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe"C:\Users\Admin\AppData\Local\Temp\5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\_5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exeC:\Users\Admin\AppData\Local\Temp\_5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.4MB
- SHA256 c6c2a9509d2f7e45010e1f72163502d4e3b8c1f33bd297a4c6026711c588f574
- MD5 e281023df7f7fb2cdde0d40397bf8230
- SHA1 f07fddaeb015e62e21e7dd28640b4ee67e0eb796
- SHA512 f0eed68af7ff8d13475e37cd57c9fdc1c41f6607a9afec86504040693b0df13b8a125dd87f2b5f61acc79b5dde5fcb5ecfa5ab129f1bb9f0bccb38b300081ced
- SSDEEP 12288:9ja7a3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bk:9jz+gkE2fh4CoRX5SnW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3N.exe
- Size 4.3MB
- SHA256 d69c59a550ed1b68d470b94affec70deeee6dad0fcf821eadf9e21b77dacfff8
- MD5 3d33abc1c70db3a4562782955ba846f0
- SHA1 057db92c6e972d45d1c62219464cc7514d5f0982
- SHA512 7b22002d0b2bcc52d8b35cf66c43c6acbbea86546b9e35eea27e4f11f0b606b6f71eba0bdaddd28d1b64a8f08b74178f689ea5f34d954949e4634f7993797340
- SSDEEP 12288:+N3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bk:y+gkE2fh4CoRX5SnW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.4MB
- SHA256 5564dc6499bf97b6f7f1da90051de10b06fe0fa41ce4aea648c5d0f0b2ad56b3
- MD5 f7f68dfe6cca77e0db825121a8aa5940
- SHA1 8918bae90917d490bd2e656d002397c316981b97
- SHA512 4fe81fb812f595cf04b4f464f019d47f1d12ca6ce987308dd653e9a1b5124217e1d43d5735e5e5ce43bfeb424d628bfbe820a1434c089d5847ddecc864daa063
- SSDEEP 12288:9jlN3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bk:9j1+gkE2fh4CoRX5SnW
- MD5 SHA1 SHA512 SSDEEP