7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb

General

Target

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
Size

4.3MB
MD5

bf063d9fda89348906086c3b8ec1a6b4
SHA1

df24129fa947d9fb34901f629e04ffa17065f053
SHA256

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb
SHA512

fa7c707b1ab15280e618b72245e18f974ef20f5de88cc4af25354401ee27dc0c06ba90b1d8f50b0a8ee6ea92967cca98d8dc831e9ae7643199bb9cafe8456fa3
SSDEEP

24576:9jGt+gkE2fh4Coswkx2KdcPCl9AuDF5zUPGLG5SvAMZAMg9:9aUgkEaSPkx2KiPy9AuDzY

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

sysx32.exe_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

pid process

2124 sysx32.exe
2448 _7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

pid	process
2124	sysx32.exe
2448	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

Loads dropped DLL 8 IoCs

Processes:

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exeWerFault.exe

pid	process
392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
2864	WerFault.exe
2864	WerFault.exe
2864	WerFault.exe
2864	WerFault.exe
2864	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe"	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

sysx32.exe

description ioc process

File opened (read-only) \??\A: sysx32.exe
File opened (read-only) \??\B: sysx32.exe

description	ioc	process
File opened (read-only)	\??\A:	sysx32.exe
File opened (read-only)	\??\B:	sysx32.exe

Drops file in System32 directory 3 IoCs

Processes:

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exesysx32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sysx32.exe	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
File opened for modification	C:\Windows\SysWOW64\sysx32.exe	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
File created	C:\Windows\SysWOW64\sysx32.exe	sysx32.exe

Drops file in Program Files directory 2 IoCs

Processes:

sysx32.exe

description ioc process

File created C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe
File opened for modification C:\Program Files\7-Zip\7z.exe.tmp sysx32.exe

description	ioc	process
File created	C:\Program Files\7-Zip\7z.exe.tmp	sysx32.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.tmp	sysx32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

description	pid	process	target process
PID 392 wrote to memory of 2124	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	sysx32.exe
PID 392 wrote to memory of 2124	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	sysx32.exe
PID 392 wrote to memory of 2124	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	sysx32.exe
PID 392 wrote to memory of 2124	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	sysx32.exe
PID 392 wrote to memory of 2448	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
PID 392 wrote to memory of 2448	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
PID 392 wrote to memory of 2448	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
PID 392 wrote to memory of 2448	392	7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
PID 2448 wrote to memory of 2864	2448	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	WerFault.exe
PID 2448 wrote to memory of 2864	2448	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	WerFault.exe
PID 2448 wrote to memory of 2864	2448	_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
"C:\Users\Admin\AppData\Local\Temp\7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\sysx32.exe
C:\Windows\system32\sysx32.exe /scan
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2124

C:\Users\Admin\AppData\Local\Temp\_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
C:\Users\Admin\AppData\Local\Temp\_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2448 -s 536
3⤵
- Loads dropped DLL
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb.exe

Filesize
4.3MB

MD5
4298bcad4a69e0be62f523e7ae11b423

SHA1
67d2a30b4d82b3ce2ff2dcf2e6c0a4e975f415c7

SHA256
36c961b8ad83d5f3e50718facdc48db2edf0f85d4542b330fe06459c11997772

SHA512
d2fba55f86c3487fb4523f1b3ba1776058bf835bd200a10512a4a773100733837997265e2cf7d67cca54935987049dbcc4896a7ca5467b76864295410873ca82

Download Submit
C:\Windows\SysWOW64\sysx32.exe

Filesize
4.3MB

MD5
bf063d9fda89348906086c3b8ec1a6b4

SHA1
df24129fa947d9fb34901f629e04ffa17065f053

SHA256
7231914868efe6205dd1e12e58a17bad0c482468fce47c18c3ff16e39dba2cfb

SHA512
fa7c707b1ab15280e618b72245e18f974ef20f5de88cc4af25354401ee27dc0c06ba90b1d8f50b0a8ee6ea92967cca98d8dc831e9ae7643199bb9cafe8456fa3

Download Submit
memory/392-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/392-11-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/392-10-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/392-26-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2124-13-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2124-27-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2448-19-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/2448-20-0x000000013F3D0000-0x000000013F3D8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads