Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 05:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe
- Size 4.2MB
- Sample241114-gkefbavfla
- SHA256 cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c
- MD5 6e55cf74c75f9e1887ddd6f2389502ea
- SHA1 08a039770d20934d347a6c17f90838c4b4bde0dd
- SHA512 0698791f4111a20811997a4a749943817b8aa15f3c621a48ea5137a55c9c919acaeb4d8b3c573471fa29cdb48842f3a8d68f9f609efcf2f8f5c17f165c411928
- SSDEEP 49152:9kBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160c:OB+o1c0tkStykq160c
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 3932 sysx32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\X: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\expand.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ftp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\convert.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\net1.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\CloudNotifications.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\getmac.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\quickassist.exe sysx32.exe File created C:\Windows\SysWOW64\wermgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\proquota.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\whoami.exe sysx32.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ddodiag.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\quickassist.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\grpconv.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\netbtugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\comp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msdt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RpcPing.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe sysx32.exe File created C:\Windows\SysWOW64\SecEdit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\proquota.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\MRINFO.EXE.tmp sysx32.exe File created C:\Windows\SysWOW64\SearchIndexer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\setx.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\verifiergui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\cacls.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe sysx32.exe File created C:\Windows\SysWOW64\TpmInit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\doskey.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\dotnet.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.tmp sysx32.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{9733680C-0D1E-4BD2-A74F-0CCF42A8BF32}\chrome_installer.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmpshare.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\logman.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_23bb28d0952bcec8\RdpSaProxy.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\DeviceCredentialDeployment.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\f\sxstrace.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\sessionmsg.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpupdate.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\unregmp2.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\f\SgrmBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\r\gpscript.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\EaseOfAccessDialog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\r\WerFault.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.1_none_2eeab9eac7c3eb5c\WFS.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\sdchange.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5ffcb7ce21b4d707\aspnet_state.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\f\tttracer.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\RdpSaUacHelper.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.1_none_f59d207965b1bbc3\ShapeCollector.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\finger.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\r\DTUHandler.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\r\RuntimeBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\f\printui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpq.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\rmttpmvscmgrsvr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\ResetEngine.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\r\wbadmin.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\BdeUISrv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\r\Win32WebViewHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\r\printui.exe sysx32.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\SyncAppvPublishingServer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_03029e85abc99279\bitsadmin.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\f\OfflineScannerShell.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.1_none_f4025a506f9e9f01\bootim.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.1_none_e1253388ca1ca1af\DismHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\TSTheme.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\SpeechRuntime.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.1_none_126d541494a0ae5b\CCG.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\adamsync.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\mstsc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasdial.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c8f9d36146564b7f\aspnet_regiis.exe sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15805.0_none_1bb0d4ac7da3bfe1\ngentask.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\rundll32.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.19041.1_none_2a5f489c740a390b\sc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\taskhostw.exe sysx32.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15805.0_none_63e334c9a2aa569e\WsatConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3_pacjsworker.exe_6e8eaf33 sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_fce141858c5d7f03\IMEWDBLD.EXE.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\MRINFO.EXE.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\pcalua.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\f\bcdboot.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\DataExchangeHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.19041.1_none_14bead3522ecffb2\TFTP.EXE sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\unsecapp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\TSTheme.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe.tmp sysx32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3092 wrote to memory of 3932 3092 cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe 83 PID 3092 wrote to memory of 3932 3092 cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe 83 PID 3092 wrote to memory of 3932 3092 cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe"C:\Users\Admin\AppData\Local\Temp\cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.2MB
- SHA256 46a8ee473bb1a6d110abe2e32ae6f0a7f7164674ac76a717127710a7ef16ae04
- MD5 00d942fd4850219e4750276a1e6a2697
- SHA1 3be29722200df34fc2afbb17f069cdfe79ff0cc0
- SHA512 dee11d1ff990a5ccbdfb391f2680f0c4a995d4a04088dcdeb1a24727265c23766c24f37b5c782ef327dcf65159e5325abac06e5729acc2cb435b2b97e74a41fe
- SSDEEP 49152:9mgkEaSf3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160c:gma31c0tkStykq160c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.2MB
- SHA256 cf2748dbfeb2a41fbb883e2b80cb1a8050ae577a8a5541bcf20c85f4346c350c
- MD5 6e55cf74c75f9e1887ddd6f2389502ea
- SHA1 08a039770d20934d347a6c17f90838c4b4bde0dd
- SHA512 0698791f4111a20811997a4a749943817b8aa15f3c621a48ea5137a55c9c919acaeb4d8b3c573471fa29cdb48842f3a8d68f9f609efcf2f8f5c17f165c411928
- SSDEEP 49152:9kBwFbfscEmKev3KcYq1r7RISY4+jfC09VbGR0T1c0tkAxT66LV8kq160c:OB+o1c0tkStykq160c
- MD5 SHA1 SHA512 SSDEEP