8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809

Analysis

max time kernel
151s
max time network
76s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe
Size

21KB
MD5

002d68484645308d094f754708427f5a
SHA1

80c73724fbac9dd8e3fe2752f69c01665f2b2842
SHA256

8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809
SHA512

94a5cbcf487869c877429850c76871af8e925cc0bc8e5a4f6b42d8d6beec94171c2eef4db90e0c9f77bd37c1d552283e63d86744eb36c4b26a6a7341d1a68052
SSDEEP

384:vrVaAhmoKnwWLcBZcIqt0JBwmgwOsC31vRlUt5GRA7K7s1qnW5Y4R5vSfT:zVaAhmokBwbClvRlc5GRqUs1X5dR5vS7

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rcflye.exe

pid process

1232 rcflye.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

900 cmd.exe

pid	process
1232	rcflye.exe

pid	process
900	cmd.exe

Drops file in System32 directory 2 IoCs

Processes:

8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rcflye.exe	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe
File opened for modification	C:\Windows\SysWOW64\rcflye.exe	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rcflye.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rcflye.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rcflye.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe

description pid process

Token: SeIncBasePriorityPrivilege 1196 8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1196	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe

description	pid	process	target process
PID 1196 wrote to memory of 900	1196	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe	cmd.exe
PID 1196 wrote to memory of 900	1196	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe	cmd.exe
PID 1196 wrote to memory of 900	1196	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe	cmd.exe
PID 1196 wrote to memory of 900	1196	8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe
"C:\Users\Admin\AppData\Local\Temp\8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8BE433~1.EXE > nul
2⤵
- Deletes itself
PID:900

C:\Windows\SysWOW64\rcflye.exe
C:\Windows\SysWOW64\rcflye.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rcflye.exe

Filesize
21KB

MD5
002d68484645308d094f754708427f5a

SHA1
80c73724fbac9dd8e3fe2752f69c01665f2b2842

SHA256
8be4337f7ce01f6c2df43a4ff7eebfe4371bbe9977f0df453f565a5b47702809

SHA512
94a5cbcf487869c877429850c76871af8e925cc0bc8e5a4f6b42d8d6beec94171c2eef4db90e0c9f77bd37c1d552283e63d86744eb36c4b26a6a7341d1a68052

Download Submit
memory/900-55-0x0000000000000000-mapping.dmp

Download