Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe
-
Size
5.4MB
-
MD5
271e4ef8ae4166157a4f38515d0e8a6e
-
SHA1
7d1b42b5f10c2137187cbf7f0ee31e0578c7017a
-
SHA256
f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75
-
SHA512
07705cb3431c928c6f3a47a34071c94af43fcda61a94c181f1ff1ed3fefb779e52737b4b22784f53bb0068085e5e8ea0c1e4e1710825950f70773e572038207d
-
SSDEEP
49152:9G6tYEeN0LUmRXtYs65m1cyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOu2Qq:U6tYuUeY15645gaHrhdwW
Score
9/10
Malware Config
Signatures
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2876 sysx32.exe 3212 _f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\X: sysx32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\quickassist.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dialer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Dism.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\explorer.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\xcopy.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\relog.exe sysx32.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe sysx32.exe File created C:\Windows\SysWOW64\print.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OneDriveSetup.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\instnm.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tttracer.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wextract.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\hh.exe sysx32.exe File created C:\Windows\SysWOW64\runonce.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\find.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\gpupdate.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe sysx32.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\grpconv.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\verifiergui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\regini.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\clip.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\control.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe sysx32.exe File created C:\Windows\SysWOW64\bootcfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\expand.exe sysx32.exe File created C:\Windows\SysWOW64\netiougc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\xwizard.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\quickassist.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sc.exe sysx32.exe File created C:\Windows\SysWOW64\WerFault.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\chkdsk.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cmstp.exe.tmp sysx32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE sysx32.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp sysx32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe sysx32.exe File opened for modification C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe sysx32.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.tmp sysx32.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe sysx32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\WinMgmt.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\pacjsworker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.19041.1_none_c6bc59819707b32b\ComputerDefaults.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_da52541188969d5e\mcbuilder.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.1_none_e1253388ca1ca1af\DismHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\f\bdeunlock.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\f\mip.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.19041.1_none_70349c6644208282\flattemp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\MultiDigiMon.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpresult.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.789_none_9beee4eb02a5f8c7\Narrator.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1_none_7519a674b0a74929\CompatTelRunner.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\f\mmgaserver.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_d4adcbe768a8354a\aspnet_regsql.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\aspnetca.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_aae8e58aa310aa7d\eventvwr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\Taskmgr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\ntprint.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.1_none_805f7a2ac157fb08\MuiUnattend.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_56a3c953964ea509\WinMgmt.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\f\SgrmLpac.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchProtocolHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\SysResetErr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\r\XBox.TCUI.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpconfig.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\typeperf.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.19041.1_none_4caa24969a02f9c3\timeout.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVShNotify.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_639e78e5edb8f409\PickerHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrshost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc_winmgmt.exe_8f8eb7b1.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\f\CloudNotifications.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\dllhost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_f4a35974d85ff180\SettingSyncHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgusr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\typeperf.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_c367e800917abc7d\odbcconf.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1202_none_b3f538f2c4a648b2\dsregcmd.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\r\rasdial.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qprocess.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchFilterHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\chglogon.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.19041.1_none_825521fc8f4a22ac\fsutil.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\notepad.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_99318cb064fcaf44\mscorsvw.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmdl32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\SyncAppvPublishingServer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimig.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\r\hnsdiag.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\r\msoobe.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_18b14c7d1478d4cc\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\unsecapp.exe sysx32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2876 2372 f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe 83 PID 2372 wrote to memory of 2876 2372 f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe 83 PID 2372 wrote to memory of 2876 2372 f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe 83 PID 2372 wrote to memory of 3212 2372 f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe 84 PID 2372 wrote to memory of 3212 2372 f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe"C:\Users\Admin\AppData\Local\Temp\f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\_f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exeC:\Users\Admin\AppData\Local\Temp\_f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe2⤵
- Executes dropped EXE
PID:3212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD534f859e765e80e7559c99ff7e78a5938
SHA17409415e3261090e0f5f268739dd325bad76ef71
SHA256a29d4568f0dc3e73dc3afa039bae7c6614f58d5c17ad2caa77ec75dcbc4a27d1
SHA512cbc3a5ceaf1cf802c6b434bba6e5efcd0e718e640b027c27605c60c9f5befd8874a6bcf00615be9176db2517e18960c0957fefd4ff1cd0292e2b6f327858a78f
-
C:\Users\Admin\AppData\Local\Temp\_f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75.exe
Filesize5.3MB
MD57416388cde9f08f622ec11be7be02126
SHA1ccbb59c45811ef1e3e9301e4beee05aec9fc20ad
SHA256736a74e0b85a68e90465df2ac8372a117b555e00900c73d0f1a04ef61b901c7e
SHA5129366f2a87b79fe92f58b9718b84ce1b6258dc1546ca4057be5cc27604fc0580437edb2781e2acef49a7c0b1469debafeb12706873e89fbc925a1c2545f637c23
-
Filesize
5.4MB
MD5271e4ef8ae4166157a4f38515d0e8a6e
SHA17d1b42b5f10c2137187cbf7f0ee31e0578c7017a
SHA256f700fb842b5dc74b3bdd31a01c1d924634e073091f2d67e718f0a63ff44ccf75
SHA51207705cb3431c928c6f3a47a34071c94af43fcda61a94c181f1ff1ed3fefb779e52737b4b22784f53bb0068085e5e8ea0c1e4e1710825950f70773e572038207d