69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe
Size

26KB
MD5

fe9f916a6b74f2352fccee632e8664e5
SHA1

7601a71dfa0483f8d7585479c2b48fe47d7f3ea2
SHA256

69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d
SHA512

44494203856f26bdcc88496282922cea78b805102f8b0f60ac2d5a282c93e04cd760fc724f1cf684c84f8c650e5597abf49ad59bf53028300060803bff977cd3
SSDEEP

384:MqvAXxH6zoHAcIWed4+kSLqrXla7vvxlLjlN:zWxMoHNed6a7DZN

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1676	attrib.exe

Deletes itself 1 IoCs

pid	Process
2312	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1696	rwmhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\rwmhost.exe	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	attrib.exe
File created	C:\Windows\Debug\rwmhost.exe	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1676	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	30
PID 2440 wrote to memory of 1676	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	30
PID 2440 wrote to memory of 1676	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	30
PID 2440 wrote to memory of 1676	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	30
PID 2440 wrote to memory of 2312	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	33
PID 2440 wrote to memory of 2312	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	33
PID 2440 wrote to memory of 2312	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	33
PID 2440 wrote to memory of 2312	2440	69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1676	attrib.exe

C:\Users\Admin\AppData\Local\Temp\69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe
"C:\Users\Admin\AppData\Local\Temp\69d8cc340fe5f1f8fbb93f34d4e744e3f902605b28c0b7fde0002c578423c90d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\rwmhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\69D8CC~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2312

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\rwmhost.exe

Filesize
26KB

MD5
0a4d42ef1da53e7e405dfd92b508b913

SHA1
8a604effdfa4ab03c6a40055788bd3c0ed0bde3c

SHA256
f78ba6473cd7cc82a405ec578ee61e878ff6dcc958142389ee0377fa774df7a6

SHA512
5185a7b749c9add948a781d8abf3417fa2427896056c11ed5cb37eae57ea9640887525f59317dd83483d08091f1b1ceefe0e1f8cf987e8e382cc806614b4d851

Download Submit
memory/1696-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1696-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1696-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1696-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1696-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1696-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2440-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2440-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads