Static task
static1
Behavioral task
behavioral1
Sample
WWAHost.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
WWAHost.exe
Resource
win10v2004-20230220-en
General
-
Target
WWAHost.exe
-
Size
510KB
-
MD5
218d7ff8ec006caaaebe590405851af9
-
SHA1
9a21e4d38a399905b3adcb067793f736718edc34
-
SHA256
fb40a3c124fcaae8ff1e5c91acaad489da16b5ff0ef623922946881b802fcee5
-
SHA512
78ba9c8bc9dfbe5cfe126f7011d304a0e4565c9393de054a9a71ee64f3f7efecdd6510d7889b6456f1618b462309c6b859b41868842ce993cb571668938efa04
-
SSDEEP
12288:ChWcRJ3xbHF4a8hC98Kp/yfO+YiC55W4PStV5KLv8V4mw/PGTC9gSr6ne:Ccc/3xbHF4a8hC98Kp/yfO+YiC55W4PX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WWAHost.exe
Files
-
WWAHost.exe.exe windows x86
a4b4f1ba94197c9b94cef7ed09a6b67a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
strchr
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlGetVersion
wcsstr
wcschr
EtwEventRegister
EtwEventWrite
EtwEventUnregister
WinSqmEndSession
WinSqmSetDWORD
RtlFreeSid
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlFindAceByType
RtlEqualSid
RtlAllocateAndInitializeSid
RtlInitUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationToken
_wcsnicmp
NtGetCachedSigningLevel
memmove
wcsncmp
_vsnwprintf
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
memset
WinSqmAddToStreamEx
RtlCaptureContext
WinSqmStartSession
WinSqmIsOptedIn
memcpy_s
_itow_s
_chkstk
_ftol2
_ftol2_sse
memcmp
memcpy
RtlUnwind
api-ms-win-appmodel-runtime-internal-l1-1-0
GetPackagePropertyString
GetPackageApplicationPropertyString
GetPackageProperty
GetCurrentPackageApplicationContext
GetPackageOSMaxVersionTested
GetCurrentPackageContext
api-ms-win-core-url-l1-1-0
PathCreateFromUrlW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetProcAddress
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-2-0
ReleaseSRWLockExclusive
InitOnceInitialize
AcquireSRWLockExclusive
SetEvent
CreateEventW
ResetEvent
InitOnceExecuteOnce
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
SleepEx
WaitForMultipleObjectsEx
api-ms-win-core-winrt-error-l1-1-1
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoOriginateError
api-ms-win-security-base-l1-2-0
CreateWellKnownSid
CheckTokenCapability
GetTokenInformation
api-ms-win-core-errorhandling-l1-1-1
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-2
OpenProcessToken
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetProcessTimes
OpenProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWrite
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-debug-l1-1-1
DebugBreak
OutputDebugStringW
api-ms-win-core-file-l1-2-1
GetFileAttributesW
CreateFileW
GetFileSizeEx
WriteFile
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringEx
CompareStringOrdinal
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-memory-l1-1-2
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
CreateThreadpoolWork
api-ms-win-core-localization-l1-2-1
LCMapStringW
SetThreadPreferredUILanguages
FormatMessageW
api-ms-win-core-psapi-l1-1-0
K32GetProcessMemoryInfo
api-ms-win-core-path-l1-1-0
PathCchCombineEx
profapi
ord104
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-ro-typeresolution-l1-1-0
RoResolveNamespace
RoGetMetaDataFile
combase
ord87
ord86
ord110
ord90
ord111
ord88
iertutil
ord174
CreateUri
ord177
CreateIUriBuilder
api-ms-win-core-heap-l1-2-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-service-management-l1-1-0
OpenSCManagerW
CloseServiceHandle
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
Sections
.text Size: 438KB - Virtual size: 438KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
minATL Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ