Analysis
- max time kernel
93s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe
- Size 7.1MB
- Sample241114-azm8fasbmf
- SHA256 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc
- MD5 4440d39c5797e7b67836e528983ebc0c
- SHA1 175baa4097ef970f487b5ab31319fe46e86ddd14
- SHA512 4449431e32bc0a0ddd0f027668b5282f38815ef70837753b300d82ab0210945a1fd51d1b1c0b90e0c8801615f7a6593ae45e12f0a1323c989b90d2c71f005ff3
- SSDEEP 49152:9N0//jkb5L8YSgRWpAIRrRLzZiNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llD:6jk98YTOrRn+os45gaHrhdw3D7nTsR
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2648 sysx32.exe 4368 _95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\W: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\forfiles.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\iscsicpl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe sysx32.exe File created C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\fc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\charmap.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\where.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\ieUnatt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runonce.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe sysx32.exe File created C:\Windows\SysWOW64\makecab.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\mtstocom.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe sysx32.exe File created C:\Windows\SysWOW64\write.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cmstp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\explorer.exe sysx32.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe sysx32.exe File created C:\Windows\SysWOW64\sdchange.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\whoami.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cscript.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\xwizard.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\perfmon.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\eudcedit.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Netplwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe sysx32.exe File created C:\Windows\SysWOW64\help.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\makecab.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\fltMC.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\runonce.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\secinit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\doskey.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\regedit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\certutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe sysx32.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\upnpcont.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.1_none_de2fb5dcf9b35f74\taskhostw.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\f\djoin.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\r\wiaacmgr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.19200.110_none_11b0c321be81025e\SMSvcHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\mofcomp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\CustomInstallExec.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\XBox.TCUI.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\f\pcaui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\r\wscadminui.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\cscript.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_ed6c95dcd471837f\r\mmc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe sysx32.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchProtocolHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.1_none_081f0e1c3ea3d07f\sxstrace.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\f\DataUsageLiveTileTask.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15805.0_none_63e334c9a2aa569e\WsatConfig.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\r\SystemUWPLauncher.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\r\MdmDiagnosticsTool.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_d27e617a9bd9c1d3\ieinstal.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\f\WpcUapApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmstp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\hvix64.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\wscadminui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\r\WerFaultSecure.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_18e6b82c93a9c5f6\xcopy.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\IEChooser.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1_none_039ee78ea24cb495\dmclient.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\r\Magnify.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\WSCollect.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_2305f6cf48d996c7\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\r\sdclt.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_9556bb9420781f39\sdbinst.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_bc34aea0c10c4a99\setupugc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\r\netiougc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winload.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1_none_b6a6a2ae8b1ec7b0\vfpctrl.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_260e545bf60f6b0f\cliconfg.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\r\PinningConfirmationDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\r\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVShNotify.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_3b03b28c788655c6\PrintDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\ThumbnailExtractionHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\dstokenclean.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\sihost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\f\WinRTNetMUAHostServer.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_6b92f924ed7df79b\fixmapi.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\wsmprovhost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_512e9d368c70b758\r\iexplore.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.1151_none_f7be996d8409bfa1\wsl.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\immersivetpmvscmgrsvr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.19041.1_none_d1ffdc3927836528\WmsManager.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.19041.1_none_0b147d237ce650c5\forfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\wmpnetwk.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\r\cleanmgr.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3088 wrote to memory of 2648 3088 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe 83 PID 3088 wrote to memory of 2648 3088 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe 83 PID 3088 wrote to memory of 2648 3088 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe 83 PID 3088 wrote to memory of 4368 3088 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe 84 PID 3088 wrote to memory of 4368 3088 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe"C:\Users\Admin\AppData\Local\Temp\95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2648
-
-
C:\Users\Admin\AppData\Local\Temp\_95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exeC:\Users\Admin\AppData\Local\Temp\_95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe2⤵
- Executes dropped EXE
PID:4368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 7.1MB
- SHA256 cc4be0db54e69a8754426b4595210f5238df028187ce9f9491e0a9873c37a975
- MD5 aab4d41c280eeed4f62e05c4a382a2e0
- SHA1 bdb55d5baeec5ab45b4f5456997866fcce9fe33b
- SHA512 a024099d430355af698363fafe6be3ba32d824aa03b780c7b9a438f1e8569fa19f18c1262f870d6842a2f43aecf58aa3198bf7d51bacc1c19aa4a714e3082b0d
- SSDEEP 49152:9mgkEaSgRWpAIRrRLzZiNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOm:gmaTOrRn+os45gaHrhdw3D7nTsR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc.exe
- Size 7.1MB
- SHA256 f6e3642590a3088a8f937937b45bbc7b1c8211da8625ae363a0eab80716877b1
- MD5 c256c8f714f10008de522fdf3c4ded13
- SHA1 8bbea31a1186da6554947843da0741f975340352
- SHA512 15beca61f5f88486ca8fbf87579d9faf71305650bd76be558e98d524dcdc4cf3426e7a11ded9ffed2a77487067ae248c30b8ce67279b86b29d93cab71fae5b31
- SSDEEP 49152:U0//jkb5L8YSgRWpAIRrRLzZiNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxh:Jjk98YTOrRn+os45gaHrhdw3D7nTsR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 7.1MB
- SHA256 95b3c2fc807c29e3af211445e0c7ea4c68822219f075f0003581d2225f06e9dc
- MD5 4440d39c5797e7b67836e528983ebc0c
- SHA1 175baa4097ef970f487b5ab31319fe46e86ddd14
- SHA512 4449431e32bc0a0ddd0f027668b5282f38815ef70837753b300d82ab0210945a1fd51d1b1c0b90e0c8801615f7a6593ae45e12f0a1323c989b90d2c71f005ff3
- SSDEEP 49152:9N0//jkb5L8YSgRWpAIRrRLzZiNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llD:6jk98YTOrRn+os45gaHrhdw3D7nTsR
- MD5 SHA1 SHA512 SSDEEP