afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe
Size

199KB
MD5

bde51f3296a69762510b91c144cae2da
SHA1

4f42c625e0befa5a89a44aae7974069198372dac
SHA256

afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b
SHA512

7135b78931d989fe4ebcf6f1a83563dcde2a376b57990925e3e2d4a390869819cd38ab34e1882092091485e582d10ec4edd0420dd754a867158c9ac72f01b617
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO4:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXZ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2604	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2084	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2604	2084	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	29
PID 2084 wrote to memory of 2604	2084	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	29
PID 2084 wrote to memory of 2604	2084	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	29
PID 2084 wrote to memory of 2604	2084	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	29

C:\Users\Admin\AppData\Local\Temp\afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe
"C:\Users\Admin\AppData\Local\Temp\afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AFE94C~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2604

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\rwmhost.exe

Filesize
200KB

MD5
3284ed6ed9f0fc6d7d28bd782b2716ca

SHA1
399f44c18fd6004e881c6401d193ac3308818181

SHA256
cfeaefea5ccda280d7e4576e5eb133fc13b2fb3ba17311b61c615556a3753509

SHA512
26e46a2ea0cdd8db7c2098fd30f4f6d01d277fa9d87b8872937ac716a46e86e8729dafbeda15b56ebc2de7b70c93bed1b924f0f5492002d02fbd0e50cad8efee

Download Submit
C:\Windows\debug\rwmhost.exe

Filesize
200KB

MD5
3284ed6ed9f0fc6d7d28bd782b2716ca

SHA1
399f44c18fd6004e881c6401d193ac3308818181

SHA256
cfeaefea5ccda280d7e4576e5eb133fc13b2fb3ba17311b61c615556a3753509

SHA512
26e46a2ea0cdd8db7c2098fd30f4f6d01d277fa9d87b8872937ac716a46e86e8729dafbeda15b56ebc2de7b70c93bed1b924f0f5492002d02fbd0e50cad8efee

Download Submit