Analysis
- max time kernel
95s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 02:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe
- Size 977KB
- Sample241113-cjrl2avdqr
- SHA256 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da
- MD5 105f2452332818f409d9c4fa971b6195
- SHA1 93dae5439140d9a6ec3fca5dce33e2c9c45bb4b2
- SHA512 a5ee0c6c8f6cfd608646d39c0088959db7792e8119b40b32ed72f4327225af029679cfb800adf2339e3d90f371704ca9947485a3a253f721460e4bd2850a7af7
- SSDEEP 12288:9j8YQqLWENDS5lSoP7y8H+RNUDDvRP77+7qB3DWKtsm45Y:9j8YJLPNDS5lSM/eR0u7C3D1tT45Y
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3876 sysx32.exe 4988 _b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\V: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mstsc.exe sysx32.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\instnm.exe sysx32.exe File created C:\Windows\SysWOW64\mavinject.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cipher.exe sysx32.exe File created C:\Windows\SysWOW64\credwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe sysx32.exe File created C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\iscsicli.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\regini.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\systray.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\help.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\setup16.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tar.exe sysx32.exe File created C:\Windows\SysWOW64\Utilman.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\extrac32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe sysx32.exe File created C:\Windows\SysWOW64\tttracer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\GameBarPresenceWriter.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PickerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe sysx32.exe File created C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\regini.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ndadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\replace.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\verclsid.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Magnify.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe sysx32.exe File created C:\Windows\SysWOW64\auditpol.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cttunesvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\eventcreate.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ttdinject.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.tmp sysx32.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe sysx32.exe File created C:\Program Files\Windows Media Player\wmplayer.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\usocoreworker.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\r\wbengine.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_3ccd00f4f3f0b0c9\net1.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\PerceptionSimulationService.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\r\BitLockerWizardElev.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_956906931b26e27a\winrs.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\CredentialEnrollmentManager.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\f\net1.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\r\MBR2GPT.EXE.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchFilterHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\iissetup.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1081_none_ae0369bc9fe47e6c\f\appidtel.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\r\SndVol.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\f\cttunesvr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\r\WorkFolders.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_ed965939376efbbf\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\vmwp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\WFS.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\logman.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_19667e7e60cb0ccd\RdpSaProxy.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\GamePanel.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpshare.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3_csrss.exe_06529458.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_20aa8037cb026fdb\netbtugc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.1_none_34bfdd0c0f979e4b\EASPolicyManagerBrokerHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_a2eda420e70d2fc8\dsacls.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_9959f3c5e4eeac5f\cvtres.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1_none_3e1c0a49448926c6\bcdedit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.19041.1_none_9219c799710d7e86\userinit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.19041.1_none_5170c1bc799e651e\AddInProcess.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.19041.1_none_c8306252df9627cb\rekeywiz.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\f\SecureAssessmentBrowser.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\SecHealthUI.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\TRACERT.EXE sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\Utilman.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\f\psr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\ShellLauncherConfig.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\f\PeopleExperienceHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\autoconv.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\UndockedDevKit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\SecurityHealthHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\r\memtest.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\ScriptRunner.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFault.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_1b0846060f09c968\gpscript.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirpcd.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\typeperf.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\f\CameraSettingsUIHost.exe sysx32.exe File opened for modification C:\Windows\explorer.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\Magnify.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\showmount.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\f\TrustedInstaller.exe sysx32.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a790160b3d9e046c\ilasm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\r\RemoteAppLifetimeManager.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVStreamingUX.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\f\lpksetup.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\ofdeploy.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5060 wrote to memory of 3876 5060 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe 83 PID 5060 wrote to memory of 3876 5060 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe 83 PID 5060 wrote to memory of 3876 5060 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe 83 PID 5060 wrote to memory of 4988 5060 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe 84 PID 5060 wrote to memory of 4988 5060 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe 84 PID 5060 wrote to memory of 4988 5060 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe"C:\Users\Admin\AppData\Local\Temp\b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3876
-
-
C:\Users\Admin\AppData\Local\Temp\_b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exeC:\Users\Admin\AppData\Local\Temp\_b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 977KB
- SHA256 4e602f3e498f889ffd6957ef1ba87a25086a7a9f8699ed78b8c2898b259fa017
- MD5 b7c5afbadb0b15df9977bdfafb6e6e38
- SHA1 3eda8ba524c4f5e678768ab32bf7aed9488d9080
- SHA512 2958580b613ef2ec52b19469bd0db7dcfb863459683c4b872deedb1179e0e3e4b7e35a20b142920c6aea76baff059bc5c2dae445bbc36794286770c8a18bfa02
- SSDEEP 12288:9ja7a3iwbihym2g7XO3LWUQfh4CoWP77+7qB3DWKtsm45Y:9jz+gkE2fh4Co2u7C3D1tT45Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da.exe
- Size 948KB
- SHA256 c45ee99e76e3d353689c53055ab97eb2a4ff13654b28b84b0137920cc028ea20
- MD5 3c0d9693d1d3423cfb5e9e40057885c2
- SHA1 abc942f2801da7b561ad736d54043bd2ffaefb2a
- SHA512 0554b054d0846c65d7efc1545322f7c729e963aec1631f8b5d51c9475bd36095fefe0f2eade5ba82daa18866e85dc005c6a058e21760402043c68437547550b4
- SSDEEP 12288:bYQqLWENDS5lSoP7y8H+RNUDDvRP77+7qB3DWKtsm45Y:bYJLPNDS5lSM/eR0u7C3D1tT45Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 977KB
- SHA256 b898afdb54b4497315ea6ad42db7d31324fbcc7d6ec66f3feff360cd8fe0d4da
- MD5 105f2452332818f409d9c4fa971b6195
- SHA1 93dae5439140d9a6ec3fca5dce33e2c9c45bb4b2
- SHA512 a5ee0c6c8f6cfd608646d39c0088959db7792e8119b40b32ed72f4327225af029679cfb800adf2339e3d90f371704ca9947485a3a253f721460e4bd2850a7af7
- SSDEEP 12288:9j8YQqLWENDS5lSoP7y8H+RNUDDvRP77+7qB3DWKtsm45Y:9j8YJLPNDS5lSM/eR0u7C3D1tT45Y
- MD5 SHA1 SHA512 SSDEEP