Analysis
- max time kernel
92s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe
- Size 7.8MB
- Sample241113-2amddstpcp
- SHA256 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3
- MD5 5e8f315f6a73f0b470981fda713d3e56
- SHA1 37cb4c6054f67034952a45f871c03612c6cc4090
- SHA512 37e8302d013d81db9aa141bfaa79b34a26352d28a4a1b69a5c575235413e0cafc9dd566b14cb6f0bc61763ce9c0486c910e2f0ac5bd911bd553d036ffd48a364
- SSDEEP 49152:95dnMqfFLHyT+a0rNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOu2QtO:vos45gaHrhdw3D7nTsReRR9e
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2076 sysx32.exe 4768 _59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\Q: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\curl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe sysx32.exe File created C:\Windows\SysWOW64\rundll32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\certutil.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe sysx32.exe File created C:\Windows\SysWOW64\unregmp2.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\diskpart.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mshta.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\CloudNotifications.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesRemote.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe sysx32.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\icacls.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\powercfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\esentutl.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\taskkill.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\AtBroker.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cmstp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\choice.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe sysx32.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\edpnotify.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\netsh.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\recover.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\MRINFO.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zG.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe.tmp sysx32.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.tmp sysx32.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp sysx32.exe File created C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe sysx32.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe sysx32.exe File created C:\Program Files (x86)\Windows Mail\wab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp sysx32.exe File created C:\Program Files\Windows Mail\wabmig.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp sysx32.exe File created C:\Program Files\Windows Mail\wab.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15805.0_none_74baba51266f3010\AddInProcess.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.1_none_8092909bf048f7eb\mip.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\r\wiaacmgr.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\r\WWAHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCncProxy.exe.tmp sysx32.exe File created C:\Windows\sysmon.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1fc88a05b0d625c5\write.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_da52541188969d5e\mcbuilder.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\r\AccountsControlHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.19041.1_none_9ed23f0cea1bf54e\DeviceEject.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\msoobe.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\r\StartMenuExperienceHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_47ec758ff9f94aa6\TapiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_23bb28d0952bcec8\RdpSaProxy.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\DmNotificationBroker.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8ced8f07ec5dee21\iexplore.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.19041.1_none_afe6484e54f00fd0\compact.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\f\DataUsageLiveTileTask.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\r\CredentialEnrollmentManager.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\WorkFolders.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.1_none_21244f0b33e2b22d\PerceptionSimulationInput.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\msra.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\sdclt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\Taskmgr.exe sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\VmComputeAgent.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\r\imecfmui.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\setup_wm.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\f\pnputil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\r\FaceFodUninstaller.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\AppHostRegistrationVerifier.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_1278095646355851\net.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\lpksetup.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\BioIso.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.19041.1_none_d0dbd55ec26928c1\GenValObj.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.19041.1_none_56e294df085b0025\BdeHdCfg.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVDllSurrogate.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\r\spaceman.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\audit.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\TSWbPrxy.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.1_none_de2fb5dcf9b35f74\taskhostw.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\f\winresume.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.1_none_15ad78a57833209d\CompPkgSrv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\r\XGpuEjectDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15805.0_none_cd052606b14fabac\ServiceModelReg.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1_none_da86158885d71eb7\wscadminui.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\ClipUp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_dbe4ac1121d6e6d7\CertEnrollCtrl.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\ntoskrnl.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\f\InputPersonalization.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 2092 dw20.exe Token: SeBackupPrivilege 2092 dw20.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4608 wrote to memory of 2076 4608 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 83 PID 4608 wrote to memory of 2076 4608 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 83 PID 4608 wrote to memory of 2076 4608 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 83 PID 4608 wrote to memory of 4768 4608 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 84 PID 4608 wrote to memory of 4768 4608 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 84 PID 4768 wrote to memory of 2092 4768 _59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 85 PID 4768 wrote to memory of 2092 4768 _59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe"C:\Users\Admin\AppData\Local\Temp\59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\_59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exeC:\Users\Admin\AppData\Local\Temp\_59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 8043⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 7.8MB
- SHA256 5830d14244ef2d4a7940db2038d227154028c4cf3e79b6ca3f98b0702ff56a31
- MD5 837f39c2eb5c8ba3b4ef54121d8636bb
- SHA1 c9161c05fcfd9b572bed77a451f6b9fc7ee6eb07
- SHA512 b04a04bfb279d55f895bb34526d4e7a712c5d601f8f62100f1f762036174c989fb4e7fae25d93c6e7a4ed3c38838e8aed70c1a074e4fdae83b971723cb75e47e
- SSDEEP 49152:9mgkEaSCHyT+a0rNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOu2Qt7y:gmaVos45gaHrhdw3D7nTsReRR9e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3.exe
- Size 7.8MB
- SHA256 6c43b903b02ebdbecd468c2f9e4a7beb2dd54358a2a989c1878858c8a2a2fb34
- MD5 8631cdcbfc5f578c1e9a25d0bbde453c
- SHA1 e51a495eb45eea32f78705899bae467a4c5e0c54
- SHA512 af6117f1ead317ca041fb14a97639ee8bc727168c44917694f7dfd9b125fb55ceb660c34cea53553f5188a5b30d2189ba5d35094e3ca7b3fef8196e4a27b1ad0
- SSDEEP 49152:sdnMqfFLHyT+a0rNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOu2Qt7y:Kos45gaHrhdw3D7nTsReRR9e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 7.8MB
- SHA256 59342a4894283a74c9aa97d555b095cb8ee8aa43907e4707077fbb01a83262f3
- MD5 5e8f315f6a73f0b470981fda713d3e56
- SHA1 37cb4c6054f67034952a45f871c03612c6cc4090
- SHA512 37e8302d013d81db9aa141bfaa79b34a26352d28a4a1b69a5c575235413e0cafc9dd566b14cb6f0bc61763ce9c0486c910e2f0ac5bd911bd553d036ffd48a364
- SSDEEP 49152:95dnMqfFLHyT+a0rNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOu2QtO:vos45gaHrhdw3D7nTsReRR9e
- MD5 SHA1 SHA512 SSDEEP