Analysis
- max time kernel
94s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
- Target c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe
- Size 4.4MB
- Sample241114-k8rmbsxaql
- SHA256 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6
- MD5 0587901cb341309f079e4b940b53ed06
- SHA1 08bb07f9c5a088419e9557bd9d2f8f9f853ab958
- SHA512 88fee93da44848fb9b440c038a37e74f8e2bbec5a91145f0beff0b15e0a2ca4e6920037b8e1bbfe2bd818b5a63ce2f14b89b1143998c739d7d72232878b73f08
- SSDEEP 12288:9jlN3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bkf:9j1+gkE2fh4CoRX5SnWK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation _c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe - Executes dropped EXE 2 IoCs
pid Process 2464 sysx32.exe 5020 _c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\W: sysx32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\systray.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cipher.exe sysx32.exe File created C:\Windows\SysWOW64\gpresult.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RMActivate.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\sdiagnhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\where.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wusa.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ReAgentc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\timeout.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sort.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\explorer.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\quickassist.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\resmon.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\find.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\secinit.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\winrs.exe sysx32.exe File created C:\Windows\SysWOW64\xwizard.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe sysx32.exe File created C:\Windows\SysWOW64\fc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\logagent.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logman.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\SyncHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\whoami.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\srdelayed.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe sysx32.exe File created C:\Windows\SysWOW64\ftp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\label.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WWAHost.exe sysx32.exe File created C:\Windows\SysWOW64\dxdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe sysx32.exe File created C:\Windows\SysWOW64\RmClient.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe sysx32.exe File created C:\Windows\SysWOW64\calc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RpcPing.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\diskperf.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dllhst3g.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\shrpubw.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\curl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\where.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe sysx32.exe File created C:\Windows\SysWOW64\resmon.exe.tmp sysx32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.tmp sysx32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp sysx32.exe File created C:\Program Files\Windows Mail\wab.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe.tmp sysx32.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.tmp sysx32.exe File opened for modification C:\Program Files\RestartUndo.exe sysx32.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.tmp sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.tmp sysx32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15805.0_none_63e334c9a2aa569e\WsatConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.1_none_760acfd88cf7390d\MuiUnattend.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\upnpcont.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\f\DiagnosticsHub.StandardCollector.Service.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\wdagtool.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\MusNotificationUx.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vds.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\r\Defrag.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\WinMgmt.exe sysx32.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\XblGameSaveTask.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\f\bcdboot.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.746_none_937e52b9922bd791\certutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\wsmprovhost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\r\vmms.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\logman.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc_winmgmt.exe_8f8eb7b1.tmp sysx32.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_3fc8ddfd98ad3137\IEExec.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\sdclt.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.19041.1_none_462739ece97bd4ed\vmconnect.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\change.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVDllSurrogate.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.153_none_7799fc2afae9a500\MDMAppInstaller.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCE.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_ebe59bdc3d4ddc3f\FlashUtil_ActiveX.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.19041.1_none_85d1745a1d49397f\aspnet_wp.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\CallingShellApp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15805.0_none_02d98290c2a0aa6b\jsc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\f\lpksetup.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\f\wpnpinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\r\wowreg32.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_ad9c6c9be4203192\Netplwiz.exe.tmp sysx32.exe File created C:\Windows\explorer.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\relog.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\user.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\r\printui.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\TapiUnattend.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\refsutil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15805.0_none_b2fd45ddd475eb50\ngen.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\gpresult.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\r\wmprph.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\r\TSTheme.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\r\WorkFolders.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\r\SettingSyncHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_ad4ed32c0facc27c\w32tm.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.19041.1_none_c3f8c36f1ece6e4e\ilasm.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2537dd4c480ec91b\rasphone.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\f\StartMenuExperienceHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.1_none_9b8799837b1e944c\WindowsSandboxClient.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\print.exe.tmp sysx32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3484 wordpad.exe 3484 wordpad.exe 3484 wordpad.exe 3484 wordpad.exe 3484 wordpad.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2464 2116 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 83 PID 2116 wrote to memory of 2464 2116 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 83 PID 2116 wrote to memory of 2464 2116 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 83 PID 2116 wrote to memory of 5020 2116 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 84 PID 2116 wrote to memory of 5020 2116 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 84 PID 5020 wrote to memory of 3484 5020 _c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 87 PID 5020 wrote to memory of 3484 5020 _c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe"C:\Users\Admin\AppData\Local\Temp\c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\_c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exeC:\Users\Admin\AppData\Local\Temp\_c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\RestartUndo.exe
- Size 4.4MB
- SHA256 f09c8420393b0d546e74671576e3c651dfa964dcdfd5007cea71dd4b5d0e7a1a
- MD5 056252959f9df2d84de959e20f18d579
- SHA1 4f8fdbff6c9ddf1f96aba4602af0875188d5bda0
- SHA512 96464f5a070b3977374e07649f998a813206ee35d76139869af45d1bee5deac9757f0292d411347447a13586e6294f6220a502504b2893a08bd38cee3134e0d5
- SSDEEP 24576:9jQAsJPwOneVvacXlGpE2fh4CoRX5SnWK:991sFEaSI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6.exe
- Size 4.3MB
- SHA256 0682801e8dfa2eca8e3996a345b59ac2cd3f577a77a4ee62f8b37ee3ba8231db
- MD5 8500c19465fae084d7fab94c8dc44ce1
- SHA1 9571464969962e645a2c1fad28c3026b9ddc825c
- SHA512 3bfe77c8625a1a90579f7bfc47a4595357a510b06724d4b3a83df2936a2a2f3d060f13bc520efee357abc23a2a0d7c735c20bd18b3925d0f1a0dc4341a00c748
- SSDEEP 12288:+N3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bkf:y+gkE2fh4CoRX5SnWK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sysx32.exe
- Size 4.4MB
- SHA256 c9ff554ad2c26b8a734b8c85fe083ebe55ceabca3d6bfd7e6f3ee8f32cc00ec6
- MD5 0587901cb341309f079e4b940b53ed06
- SHA1 08bb07f9c5a088419e9557bd9d2f8f9f853ab958
- SHA512 88fee93da44848fb9b440c038a37e74f8e2bbec5a91145f0beff0b15e0a2ca4e6920037b8e1bbfe2bd818b5a63ce2f14b89b1143998c739d7d72232878b73f08
- SSDEEP 12288:9jlN3iwbihym2g7XO3LWUQfh4CoRQYZTWbDjJc9bkf:9j1+gkE2fh4CoRX5SnWK
- MD5 SHA1 SHA512 SSDEEP