8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe
Size

198KB
MD5

d8367c505967aa8a38d008da5e889c03
SHA1

f1d39e1626eb002e75c13c154b08708c4dd3419d
SHA256

8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f
SHA512

139e4542a325264154a0db264352f272e06a54d6c613976ed7cbdc62b314fe1893f84f90a00e5fba16be05bc114e5bdff368469413162f792498e45d643ebfb1
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO7:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX2

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2996	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2176	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2760	2176	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe	29
PID 2176 wrote to memory of 2760	2176	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe	29
PID 2176 wrote to memory of 2760	2176	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe	29
PID 2176 wrote to memory of 2760	2176	8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe	29

C:\Users\Admin\AppData\Local\Temp\8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe
"C:\Users\Admin\AppData\Local\Temp\8f6d841e749b6fed45f99ae4afc0a83bef5a057156cf8b46f53fdd03f5f66a5f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8F6D84~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2760

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\rwmhost.exe

Filesize
198KB

MD5
f83a2ef564053dc9e8a815438d09cc56

SHA1
8d065fa1c0a3de8b82e1fdacae57d743c5f37d9f

SHA256
0f5a40ca01085e21df6e2f24e6a8942c5a2f3f699171fca9b02a95d7e167b2b7

SHA512
9f2870c96b54afb6fe7a3ebb7766028849c059cad9d8bb96ff99a2e572b18355227617eebb0d1a6ee27814b5a89e41f1786406c8aebfb31460bda0bb07fb65b3

Download Submit
C:\Windows\debug\rwmhost.exe

Filesize
198KB

MD5
f83a2ef564053dc9e8a815438d09cc56

SHA1
8d065fa1c0a3de8b82e1fdacae57d743c5f37d9f

SHA256
0f5a40ca01085e21df6e2f24e6a8942c5a2f3f699171fca9b02a95d7e167b2b7

SHA512
9f2870c96b54afb6fe7a3ebb7766028849c059cad9d8bb96ff99a2e572b18355227617eebb0d1a6ee27814b5a89e41f1786406c8aebfb31460bda0bb07fb65b3

Download Submit