Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 13:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe
-
Size
4.9MB
-
MD5
0dff821f821d28ba2001592c4ee558b1
-
SHA1
836548583ccef791243b4e4e4f7b4a307ab0210a
-
SHA256
ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb
-
SHA512
f7460b4e584a1917cf412915420a78171050713bc667b253719df4539b95f327e4c8ffd8329cb2ca6dd08a494ca9d7a5b0f5f186ba7e33007db0637812ec74da
-
SSDEEP
49152:9aR9dH40N5tgGDn0a2qnqYQVMkL+q/vSWidGHp+NDGQUzbpDOfjxAkrQKl+RPAFz:kdH4AyklJKvS0Hpe4zbpaAKQkroGIC
Score
9/10
Malware Config
Signatures
-
Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 432 sysx32.exe 5112 _ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\Z: sysx32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mavinject.exe sysx32.exe File created C:\Windows\SysWOW64\openfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\at.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\dialer.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\charmap.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cipher.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\tar.exe sysx32.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe sysx32.exe File created C:\Windows\SysWOW64\attrib.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe sysx32.exe File created C:\Windows\SysWOW64\schtasks.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe sysx32.exe File created C:\Windows\SysWOW64\mountvol.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logagent.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Register-CimProvider.exe sysx32.exe File created C:\Windows\SysWOW64\setup16.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\at.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\cleanmgr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\tasklist.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe sysx32.exe File created C:\Windows\SysWOW64\upnpcont.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wextract.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\notepad.exe sysx32.exe File created C:\Windows\SysWOW64\Dism.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\notepad.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe sysx32.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\mobsync.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msdt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\waitfor.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wscript.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe sysx32.exe File created C:\Windows\SysWOW64\certreq.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\xwizard.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\sysx32.exe ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe File created C:\Windows\SysWOW64\edpnotify.exe.tmp sysx32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.tmp sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.tmp sysx32.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe.tmp sysx32.exe File created C:\Program Files\7-Zip\7zG.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.tmp sysx32.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.tmp sysx32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe sysx32.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp sysx32.exe File created C:\Program Files\Mozilla Firefox\updater.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe sysx32.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe sysx32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\FaceFodUninstaller.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\f\omadmclient.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\BrowserCore.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\r\prevhost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1fc88a05b0d625c5\write.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\wlrmdr.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_22ccf50c942e2ac7\TokenBrokerCookies.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\f\dnscacheugc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\f\WpcTok.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\r\PinEnrollmentBroker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_a2fa28d9db4c0081\w32tm.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\TextInputHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_62dc6b73f7e78431\ftp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\wscript.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_cc9d1ee374152f46\UserAccountBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\f\pacjsworker.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_1278095646355851\net.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\f\UserAccountBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\f\SndVol.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\MoUsoCoreWorker.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\7deea44536e5d7012c9b00001815341f.InetMgr6.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmdl32.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\PasswordOnWakeSettingFlyout.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\eshell.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\WpcMon.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_291e1d3069ab2f3a\diskpart.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\EaseOfAccessDialog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.19041.1_none_9c6e71eba56e4081\userinit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrshost.exe sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_a6017688e5093466\dcdiag.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_765fc5f6e37c509d\ieinstal.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_52c6583f47afba7a\convert.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.19041.1_none_b6b53473f278f7cc\repadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\f\Microsoft.ECApp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_e6307765e4f96817\msfeedssync.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmplayer.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrm.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\wlrmdr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\agentactivationruntimestarter.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_cb8306be5498a914\imjpuexc.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\logman.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\f\tttracer.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\f\agentactivationruntimestarter.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\f\UserAccountBroker.exe sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\SyncAppvPublishingServer.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\r\bfsvc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1_none_7519a674b0a74929\CompatTelRunner.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpresult.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\resmon.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\f\DTUHandler.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.19041.1_none_65c819c8f144c1f4\msdt.exe.tmp sysx32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4184 wrote to memory of 432 4184 ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe 82 PID 4184 wrote to memory of 432 4184 ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe 82 PID 4184 wrote to memory of 432 4184 ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe 82 PID 4184 wrote to memory of 5112 4184 ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe 83 PID 4184 wrote to memory of 5112 4184 ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe"C:\Users\Admin\AppData\Local\Temp\ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\_ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exeC:\Users\Admin\AppData\Local\Temp\_ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe2⤵
- Executes dropped EXE
PID:5112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD51aa62785070a77070ff251c3b178a3ea
SHA11e9eb378bf4941950120c4dfdb5c60c7fea32def
SHA256430904277aec540f505989e734a7238a0e54476164076c8418787893667d857b
SHA5124fdfeea60b93c35347c64d03d5ac219d4512e41f38d43331cbd43d43db2c153cb66750ad7c9abe2228608317d47837f6ce9a866be04a94a62ccd7ce227f29add
-
C:\Users\Admin\AppData\Local\Temp\_ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb.exe
Filesize4.9MB
MD5a6e8fc5f91905a5ce6a4d6d0734502f0
SHA1574a25133a8044e16959d3302e9e479014d11332
SHA256b680968188fbb61dc46f4a1f37ffebec3d1a5a3bd9a0fa5c0397917d157828cb
SHA51213ca319f875fb2699abe205754ac84f99e19e6c864f3b410d07137f9bbb76fa3226b783d338a9fc57439c8d86ac1fbe79e41fbbecbd684ea4dcf8d9bbf78c840
-
Filesize
4.9MB
MD50dff821f821d28ba2001592c4ee558b1
SHA1836548583ccef791243b4e4e4f7b4a307ab0210a
SHA256ff6a3bc077fbe53c7b976f7b965fd8919e42962c5b4280e12bfb68b962b3c8fb
SHA512f7460b4e584a1917cf412915420a78171050713bc667b253719df4539b95f327e4c8ffd8329cb2ca6dd08a494ca9d7a5b0f5f186ba7e33007db0637812ec74da