53f099e33b64c7c7953716bd4a5f7b980c745658c7ab6ebe96add4481ca4c5da

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4480282286edf7ff58175f8dba777e30.exe
Size

555KB
MD5

4480282286edf7ff58175f8dba777e30
SHA1

018a46d8121e9dabce3230543e977997e8a9c0ef
SHA256

53f099e33b64c7c7953716bd4a5f7b980c745658c7ab6ebe96add4481ca4c5da
SHA512

5ccc885f7de27dbcd2a7b56a6467206ba2ae177dd4b3ec94869e0fd7c1e628dc56980ba9f5881a3441349544d7f3fcf675c1a6999e542693344e68964a025b3e
SSDEEP

3072:W0ljzq64LHzkQ/Rd6Qq2ZNKzCr2ql31EI2sLbD+RPgJBrI5iAaoTgeuPYV:W0ljjG3Pt2I3LigJBrPQ8g

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1732	sysx32.exe
2468	_4480282286edf7ff58175f8dba777e30.exe

Loads dropped DLL 4 IoCs

pid	Process
2180	4480282286edf7ff58175f8dba777e30.exe
2180	4480282286edf7ff58175f8dba777e30.exe
2180	4480282286edf7ff58175f8dba777e30.exe
2180	4480282286edf7ff58175f8dba777e30.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe"	4480282286edf7ff58175f8dba777e30.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	sysx32.exe
File opened (read-only)	\??\B:	sysx32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sysx32.exe	4480282286edf7ff58175f8dba777e30.exe
File created	C:\Windows\SysWOW64\sysx32.exe	sysx32.exe
File created	C:\Windows\SysWOW64\sysx32.exe	4480282286edf7ff58175f8dba777e30.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe.tmp	sysx32.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.tmp	sysx32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1732	2180	4480282286edf7ff58175f8dba777e30.exe	17
PID 2180 wrote to memory of 1732	2180	4480282286edf7ff58175f8dba777e30.exe	17
PID 2180 wrote to memory of 1732	2180	4480282286edf7ff58175f8dba777e30.exe	17
PID 2180 wrote to memory of 1732	2180	4480282286edf7ff58175f8dba777e30.exe	17
PID 2180 wrote to memory of 2468	2180	4480282286edf7ff58175f8dba777e30.exe	16
PID 2180 wrote to memory of 2468	2180	4480282286edf7ff58175f8dba777e30.exe	16
PID 2180 wrote to memory of 2468	2180	4480282286edf7ff58175f8dba777e30.exe	16
PID 2180 wrote to memory of 2468	2180	4480282286edf7ff58175f8dba777e30.exe	16

C:\Users\Admin\AppData\Local\Temp\_4480282286edf7ff58175f8dba777e30.exe
C:\Users\Admin\AppData\Local\Temp\_4480282286edf7ff58175f8dba777e30.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\SysWOW64\sysx32.exe
C:\Windows\system32\sysx32.exe /scan
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1732

C:\Users\Admin\AppData\Local\Temp\4480282286edf7ff58175f8dba777e30.exe
"C:\Users\Admin\AppData\Local\Temp\4480282286edf7ff58175f8dba777e30.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sysx32.exe

Filesize
28KB

MD5
63cd9e8f7604181d1f8ec9ccae2f87c5

SHA1
386b0f1313a2ad1ba8245169999e834ff2c2f84c

SHA256
a3e5998dc48393c4827cc076d4ff15aa9f815b0b5dbcc4ec6b2ec35d3f828fc3

SHA512
6c50b51a40792819af6c2651ae99d4c9cfc10d330612b9a1cf3f995795fe2f0a36ec9c4383dcd732a691505f51369dcaff4273f84d6428bb157f6e535a354fbc

Download Submit
\Windows\SysWOW64\sysx32.exe

Filesize
20KB

MD5
9c728fc3e2caa9066d4036ed735e7203

SHA1
f4d4dd8eab75b255891888844ce2f117394ef178

SHA256
fe823af098036cfadc4e8acdf33abe845e6c7a07ffccc55c3ed14510a3120a9a

SHA512
cad650a2263ff88c47637bc4ce2ca36b976561ed9decb1454c2ad5ef6fdf689dd076b678fe39eedf33474d4e47a1d106a623e3b35af3f8ef9aed0862093de47d

Download Submit
memory/1732-21-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2180-20-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2180-11-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/2180-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads