b6e3f55e782b32b91d567d72f311e72b568868ac69c8b30463784183dbfd5e7c

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79dfe5ea5507803447f3806519675d4a.exe
Size

475KB
MD5

79dfe5ea5507803447f3806519675d4a
SHA1

00009134f0c89d8bfa3b65592b4086d292050277
SHA256

b6e3f55e782b32b91d567d72f311e72b568868ac69c8b30463784183dbfd5e7c
SHA512

0afa8c6de9a46e7b46e15c5809ea63031f90e6cb023088f632b8367f968640a80b0f8c2ead61615e0d1a491a433eaae57fa47d7f67291f55e29810cdb1b62ca2
SSDEEP

1536:ur3Z5IfQmv81a1xyXHZ+NGQSLNmCm6oyz7jBd7qDmbNPMJAVC+++Z:yJOfQm01mxyXHZKG7pm6j77R

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1592	attrib.exe

Deletes itself 1 IoCs

pid	Process
1412	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	rwmhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	79dfe5ea5507803447f3806519675d4a.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	79dfe5ea5507803447f3806519675d4a.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	888	79dfe5ea5507803447f3806519675d4a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1592	888	79dfe5ea5507803447f3806519675d4a.exe	18
PID 888 wrote to memory of 1592	888	79dfe5ea5507803447f3806519675d4a.exe	18
PID 888 wrote to memory of 1592	888	79dfe5ea5507803447f3806519675d4a.exe	18
PID 888 wrote to memory of 1592	888	79dfe5ea5507803447f3806519675d4a.exe	18
PID 888 wrote to memory of 1412	888	79dfe5ea5507803447f3806519675d4a.exe	27
PID 888 wrote to memory of 1412	888	79dfe5ea5507803447f3806519675d4a.exe	27
PID 888 wrote to memory of 1412	888	79dfe5ea5507803447f3806519675d4a.exe	27
PID 888 wrote to memory of 1412	888	79dfe5ea5507803447f3806519675d4a.exe	27

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1592	attrib.exe

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\rwmhost.exe
1⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:1592

C:\Users\Admin\AppData\Local\Temp\79dfe5ea5507803447f3806519675d4a.exe
"C:\Users\Admin\AppData\Local\Temp\79dfe5ea5507803447f3806519675d4a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\79DFE5~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\rwmhost.exe

Filesize
94KB

MD5
7b720198ea6b77d97ac5bb0065d79e6a

SHA1
ec976e77bc1a871962bd161c703f6e00d95cb8da

SHA256
d7330f1e61d78f311317a98489fb909067125b1c90541d632fcc26822d7eca68

SHA512
18554e8256e2aa038f85c6b07fffdb30279d45e51641ab0742b638bb297c86e339bb796d8ded8d71676b199b323a14589a49b1667aae5c6f8bfd33ff9ce5e2fc

Download Submit
C:\Windows\debug\rwmhost.exe

Filesize
92KB

MD5
942d2f954e361f29af98ab9186335dec

SHA1
cf8153dc5549a21516e428660d702ff9645ab255

SHA256
9cd658aa467cdc115ea6df9973425a06e225a02125e4bdd17d8fe9f4092134c7

SHA512
7bd2bff4cb932ec1b58a4b4769fa7b7a905f9a86515dac6545d713aa5b67052a3d3328cb10c7100df6add3e852542db680de8fb0bedcc949762af5ed522d1eaf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads