Analysis
- max time kernel
94s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe
- Size 4.3MB
- Sample241113-dmg3faymdp
- SHA256 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a
- MD5 e1b02148793c5c493ee3b18921c602a2
- SHA1 c0c4f261462d652877f061bfdd19607c0a0a3c16
- SHA512 936fb6c5d052b2e026b1e9a5e40e30351c177d84c4251883865903f688d3bad029e9d6a3cd35d5327899282742222dc4db4909e2f157fdcf4d903eb7c497cf6c
- SSDEEP 49152:977tpRwUbEBEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:JlZGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3668 sysx32.exe 3516 _d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Q: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe sysx32.exe File created C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe sysx32.exe File created C:\Windows\SysWOW64\unregmp2.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\getmac.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe sysx32.exe File created C:\Windows\SysWOW64\appidtel.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\certutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe sysx32.exe File created C:\Windows\SysWOW64\gpupdate.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\w32tm.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cliconfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runonce.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\findstr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\regini.exe sysx32.exe File created C:\Windows\SysWOW64\rundll32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\takeown.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe sysx32.exe File created C:\Windows\SysWOW64\fc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\getmac.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sfc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logagent.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\hh.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\netsh.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmd.exe sysx32.exe File created C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe sysx32.exe File created C:\Windows\SysWOW64\explorer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\sethc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe sysx32.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe sysx32.exe File created C:\Windows\SysWOW64\gpscript.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cmdkey.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe sysx32.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp sysx32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.tmp sysx32.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp sysx32.exe File created C:\Program Files\Windows Media Player\setup_wm.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8ced8f07ec5dee21\iexplore.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.19041.1_none_dd2098e5f9122dff\findstr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\unlodctr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.153_none_95ba73d08e5f739c\r\provtool.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\f\Robocopy.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\immersivetpmvscmgrsvr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.1_none_3ce17495646dbeaa\AppHostRegistrationVerifier.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_c55149b3997ff9cd\SystemUWPLauncher.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.19041.1_none_3d1291badd9e7f22\OposHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsirpcd.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1_none_2e738f426c6e2839\Magnify.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browser_broker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.1_none_f59d207965b1bbc3\InputPersonalization.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2d66868246722e10\OpenWith.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\perfmon.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\rundll32.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.19041.1_none_bbc1ad79155f896a\ExtExport.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\ApplySettingsTemplateCatalog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\AuditShD.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\r\Robocopy.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.423_none_6c05a0526bbe14de\UserAccountControlSettings.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\f\AtBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\f\PerceptionSimulationService.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\f\VSSVC.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.1_none_76b501b13155d66b\WmsSvc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\TiWorker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\LaunchTM.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\f\psr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFault.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\relog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\r\setup_wm.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\f\DataUsageLiveTileTask.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7_mpcmdrun.exe_1d1038c2 sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\msra.exe sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15805.0_none_14b25cddc5cbd4b2\ServiceModelReg.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\f\SystemUWPLauncher.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\r\AppVClient.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\cttunesvr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.19041.1_none_4547ebb03c53c11a\DataSvcUtil.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\r\appcmd.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\r\sdbinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\f\mip.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\r\imecfmui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\r\Magnify.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\user.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\msinfo32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\CompPkgSrv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_ff0c3fa49f6aa0fe\dsacls.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\SpaceAgent.exe sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a_wowreg32.exe_94fc2d06.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_2305f6cf48d996c7\sethc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\f\ThumbnailExtractionHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\f\FaceFodUninstaller.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\SgrmLpac.exe sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4052 wrote to memory of 3668 4052 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe 85 PID 4052 wrote to memory of 3668 4052 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe 85 PID 4052 wrote to memory of 3668 4052 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe 85 PID 4052 wrote to memory of 3516 4052 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe 86 PID 4052 wrote to memory of 3516 4052 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe"C:\Users\Admin\AppData\Local\Temp\d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\_d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exeC:\Users\Admin\AppData\Local\Temp\_d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe2⤵
- Executes dropped EXE
PID:3516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.3MB
- SHA256 7b9e24f846e044f82849301a5638f6b36ece563083b4e23799f2e61f84deb9ec
- MD5 6e93653e09e01bafc211aff0ba28859b
- SHA1 e4fb62421582a7ef483546fc70c554e0881c29e1
- SHA512 b4b658a2b884c41d14412f669007e6fdf6d10d30b0feaf3246b9032ef81d5bba15a455abaed38b4f560864851b1d6000f5b88378adf38a0bc8d8039ae73c38e6
- SSDEEP 49152:9mgkEaSrEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:gmaLGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a.exe
- Size 4.2MB
- SHA256 ea5ac1f7a91a174f7f87fbde9091f427e0967b116481d373cd6b9bfa6f1c3695
- MD5 4ae5a5d5f18eb2eed14f786382b8a33d
- SHA1 72033df98dd75a90a8b1c5fc57c92e41213028fb
- SHA512 5470496f20454379862e6344c9dc6070734401a4272877305e0a5adcc0d53a69c31eb0492f06c87ccea646f989a5bfe88e90dec5d64e645f8f063893265d2c9b
- SSDEEP 49152:g7tpRwUbEBEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:glZGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.3MB
- SHA256 d52a0fafd7fcf7477fcfc8e99acb21062d103e7fed238bb170c148e9c2a2762a
- MD5 e1b02148793c5c493ee3b18921c602a2
- SHA1 c0c4f261462d652877f061bfdd19607c0a0a3c16
- SHA512 936fb6c5d052b2e026b1e9a5e40e30351c177d84c4251883865903f688d3bad029e9d6a3cd35d5327899282742222dc4db4909e2f157fdcf4d903eb7c497cf6c
- SSDEEP 49152:977tpRwUbEBEGOiv1Yq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160vA:JlZGOD1c0tkStykq1604
- MD5 SHA1 SHA512 SSDEEP