Analysis
- max time kernel
94s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe
- Size 4.2MB
- Sample241114-g4pqdsvkey
- SHA256 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584
- MD5 fd1836247c12599abb5424a181f4c5b0
- SHA1 a74fba2cda7ed8bd5d003834653575d036796a24
- SHA512 311cb9227e1150601b51d35ce525c5f8bd1756d1176e0113abf5b94b5ae72e4390669da9d48585b5aacbceb8739cca03c3ac9f44d71a8e2e46becda1be72076b
- SSDEEP 49152:9AdqzBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:eQB+o1c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1908 sysx32.exe 1800 _2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\Q: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fc.exe sysx32.exe File created C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\verifiergui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\MuiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe sysx32.exe File created C:\Windows\SysWOW64\at.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Dism.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\expand.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\logman.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\user.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\mobsync.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\fontview.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logagent.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cipher.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ktmutil.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\diskpart.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\taskkill.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\WWAHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\netbtugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe sysx32.exe File created C:\Windows\SysWOW64\quickassist.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe sysx32.exe File created C:\Windows\SysWOW64\TpmTool.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\certutil.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\replace.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\charmap.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe sysx32.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wowreg32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sysx32.exe 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logman.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mshta.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wiaacmgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\forfiles.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe sysx32.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe sysx32.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{1E8F5DDF-3FB3-4332-A4CC-B46FF6E6899A}\chrome_installer.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.tmp sysx32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE sysx32.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\BrowserCore.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\smartscreen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\r\refsutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.19041.1_none_03b1ddb5a4b06088\RelPost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\r\vds.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\logoff.exe sysx32.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\f\VmComputeAgent.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVDllSurrogate.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\f\TSWbPrxy.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAppMonitor.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\Setup.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\f\WinMgmt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\r\SrTasks.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15805.0_none_429bcf7adb8e23ed\AddInProcess32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\f\DismHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\NgcIso.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe sysx32.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAgentPolicyGenerator.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpksetup.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\r\bash.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\f\PnPUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\iexplore.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmstp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.19041.1_none_f0f8491ec727a0ee\ngen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\r\CHXSmartScreen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.1_none_7d903181d06247f1\CastSrv.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\setupugc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.19041.1_none_075470a68fcfb411\umount.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.19041.1_none_67326312c2487423\EduPrintProv.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\f\spaceman.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1_none_9a8a77811e17322b\LsaIso.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\r\sdbinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\r\sdbinst.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.1_none_889bae88587ac38a\hh.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.19041.1_none_4d9121ef47f5b52d\mshta.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\setup_wm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_0e22056af4d5d874\mstsc.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_00d7ad6537414f31\vbc.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.1_none_80ac2d61ac960bf3\CredentialUIBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.19041.1_none_4406801793afabed\CompMgmtLauncher.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\r\Utilman.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\r\SpeechRuntime.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_258f6f31a16a0eac\DevicePairingWizard.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\r\lsass.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\r\icsunattend.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\r\mstsc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\ApplySettingsTemplateCatalog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\LanguageComponentsInstallerComHandler.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\r\pcwrun.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\r\mmgaserver.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.1_none_ab86440d95c72095\logagent.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.1_none_e2f75fda217d5015\hvc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1202_none_24329c73afbd2316\r\DeviceCensus.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_3ccd00f4f3f0b0c9\net1.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\explorer.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1908 2268 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe 84 PID 2268 wrote to memory of 1908 2268 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe 84 PID 2268 wrote to memory of 1908 2268 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe 84 PID 2268 wrote to memory of 1800 2268 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe 85 PID 2268 wrote to memory of 1800 2268 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe 85 PID 2268 wrote to memory of 1800 2268 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe"C:\Users\Admin\AppData\Local\Temp\2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\_2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exeC:\Users\Admin\AppData\Local\Temp\_2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe2⤵
- Executes dropped EXE
PID:1800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.2MB
- SHA256 004ebe79e253e251e3b1ec9ed1e5538db6aef598e0f11c785c76911b1809f5dd
- MD5 9bd1cc36f10400c14630fbb9fcc62fd5
- SHA1 557d992a823b4b5cba1ce36277df5117e3e7b86b
- SHA512 d52d6df7540f973abd9d0407f230de11fe0dadd323e574f6f8adc06e8e4402f52a636fbc253225709979fb5183310b18f7060e455767836f97f60b30d4ccdb79
- SSDEEP 49152:9mgkEaSf3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:gma31c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584N.exe
- Size 4.2MB
- SHA256 29be8a003cb82e1ebab07c72bdd6f875c6235cbe0308e94b13954075c2bc38bf
- MD5 699e2b4e017ac9f1e0b73f7d8c647c66
- SHA1 0bb2fa1fa5788c2c0730a7187882c2d1f93e6978
- SHA512 0c9fe5ea4708825293be66024211fadd38acd7ea5c9c14da108d5dd96b8bb9f35a521cd83f60910735e0109982eb1c32fb0f8679170e9b6f1805d68e8d4397a9
- SSDEEP 49152:fdqzBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:fQB+o1c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.2MB
- SHA256 2f823f8d90b8111c42438cf2ff131de94dc335a23247893c9a5cc30f5e6e1584
- MD5 fd1836247c12599abb5424a181f4c5b0
- SHA1 a74fba2cda7ed8bd5d003834653575d036796a24
- SHA512 311cb9227e1150601b51d35ce525c5f8bd1756d1176e0113abf5b94b5ae72e4390669da9d48585b5aacbceb8739cca03c3ac9f44d71a8e2e46becda1be72076b
- SSDEEP 49152:9AdqzBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160E:eQB+o1c0tkStykq160E
- MD5 SHA1 SHA512 SSDEEP