b3956cb29535e5e4b744ee8df58edfc3a29f5079274140bef9aefe95409c60a6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe
Size

93KB
MD5

1d1ad3ecc38979de67bdd231a7fd61d0
SHA1

60b46df5c9c9b94569ac0e7c3e0e6cd6dc9e9de9
SHA256

b3956cb29535e5e4b744ee8df58edfc3a29f5079274140bef9aefe95409c60a6
SHA512

6be7197e00c33da9d96f6c2687b73997e48bc6fddad76ce48ee3afd7f7bb9cf480c2ce1374c5b6dee3d1698f6d042c70f496d365d161ed033009204cadb3c337
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7u:tiAyLN9qa+oEGrWViJSzIR6JJrWNZ0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
752	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2420	752	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	28
PID 752 wrote to memory of 2420	752	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	28
PID 752 wrote to memory of 2420	752	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	28
PID 752 wrote to memory of 2420	752	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:752
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
93KB

MD5
9f456ac7381d2de8668f2a6956130f15

SHA1
23a93dc6a45f013fce97c646b0fdc5987d49ef5b

SHA256
ab99f99cdfa0061b65530d36f6fbe91ddbd3546820479e70db026a36fcaacf73

SHA512
21ce9af52b4ecfd1099033deab15ee9d729f010b0b1d8de681e6fa84ed2f94741527a5e0c36fe6b52aea4e32d72b1fd39799d7b03579e4626faa59352d177ba4

Download Submit
\ProgramData\Update\WwanSvc.exe

Filesize
93KB

MD5
9f456ac7381d2de8668f2a6956130f15

SHA1
23a93dc6a45f013fce97c646b0fdc5987d49ef5b

SHA256
ab99f99cdfa0061b65530d36f6fbe91ddbd3546820479e70db026a36fcaacf73

SHA512
21ce9af52b4ecfd1099033deab15ee9d729f010b0b1d8de681e6fa84ed2f94741527a5e0c36fe6b52aea4e32d72b1fd39799d7b03579e4626faa59352d177ba4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads