b3956cb29535e5e4b744ee8df58edfc3a29f5079274140bef9aefe95409c60a6

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe
Size

93KB
MD5

1d1ad3ecc38979de67bdd231a7fd61d0
SHA1

60b46df5c9c9b94569ac0e7c3e0e6cd6dc9e9de9
SHA256

b3956cb29535e5e4b744ee8df58edfc3a29f5079274140bef9aefe95409c60a6
SHA512

6be7197e00c33da9d96f6c2687b73997e48bc6fddad76ce48ee3afd7f7bb9cf480c2ce1374c5b6dee3d1698f6d042c70f496d365d161ed033009204cadb3c337
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7u:tiAyLN9qa+oEGrWViJSzIR6JJrWNZ0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4848	WwanSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4848	3420	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	82
PID 3420 wrote to memory of 4848	3420	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	82
PID 3420 wrote to memory of 4848	3420	NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1d1ad3ecc38979de67bdd231a7fd61d0_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3420
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
93KB

MD5
e0d0150972298fadba45b100dd47153e

SHA1
a70a00f6825c9a876c266ca62250f970f6cb2036

SHA256
701a1c7e0606b9d90e6d98ecfd12aca9a3fcf3a2050ab130259dca92cc807350

SHA512
b4b276a9b4647247367083332ea2c40e305c8f4fa19ad5f558d10baa71b1a003960e83b9b8cbcecef7ef08607edd996354c97335987862ef3ad70b8413c2b72f

Download Submit
C:\ProgramData\Update\WwanSvc.exe

Filesize
93KB

MD5
e0d0150972298fadba45b100dd47153e

SHA1
a70a00f6825c9a876c266ca62250f970f6cb2036

SHA256
701a1c7e0606b9d90e6d98ecfd12aca9a3fcf3a2050ab130259dca92cc807350

SHA512
b4b276a9b4647247367083332ea2c40e305c8f4fa19ad5f558d10baa71b1a003960e83b9b8cbcecef7ef08607edd996354c97335987862ef3ad70b8413c2b72f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads