Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
03/02/2024, 13:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wwsm.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
General
- Target wwsm.exe
- Size 2.1MB
- Sample240203-qpl6dscffq
- SHA256 c72f5370c49197bbbec172cd7eea0290409318027c3f8d6f799b102886a6123f
- MD5 c86a06097c6059e1f67e08c1d449977a
- SHA1 b2c3ec8a8dba8bc5f8a5869bd3ead3a2391109a3
- SHA512 144fc4594b593802c6d3d4d1f1f8cd66fbe7c050aa233278c9a375d72c4b00c3bb9ed15e6577102533f695f404ffba7f34f96bfc79b56e40832ed397368fd674
- SSDEEP 49152:784RuyuFzS6R42zL7gVd/5LJnPNzq5hfCD52VAFM:72R4CGdTnPNzehQ52VAi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation wwsm.exe - Executes dropped EXE 1 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe - Loads dropped DLL 1 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe -
resource yara_rule behavioral2/files/0x000a0000000231e3-15.dat vmprotect behavioral2/memory/1788-24-0x00000000734C0000-0x00000000737A6000-memory.dmp vmprotect behavioral2/memory/1788-73-0x00000000734C0000-0x00000000737A6000-memory.dmp vmprotect - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\cwapi_32.dll GWWSM_V1.0.10.1114.exe File opened for modification C:\Windows\SysWOW64\cwapi_32.dll GWWSM_V1.0.10.1114.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\wwsm\ProcessToI.txt GWWSM_V1.0.10.1114.exe File opened for modification C:\Program Files (x86)\wwsm\ProcessToI.txt GWWSM_V1.0.10.1114.exe File opened for modification C:\Program Files (x86)\wwsm wwsm.exe File created C:\Program Files (x86)\wwsm\cwapi_32.dll wwsm.exe File created C:\Program Files (x86)\wwsm\GWWSM_V1.0.10.1114.exe wwsm.exe File created C:\Program Files\gxt\helpapi.dll GWWSM_V1.0.10.1114.exe File created C:\Program Files (x86)\wwsm\__tmp_rar_sfx_access_check_240601843 wwsm.exe File opened for modification C:\Program Files (x86)\wwsm\cwapi_32.dll wwsm.exe File opened for modification C:\Program Files (x86)\wwsm\GWWSM_V1.0.10.1114.exe wwsm.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeAssignPrimaryTokenPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeLockMemoryPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeIncreaseQuotaPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeMachineAccountPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeTcbPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeSecurityPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeTakeOwnershipPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeLoadDriverPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeSystemProfilePrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeSystemtimePrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeProfSingleProcessPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeIncBasePriorityPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeCreatePagefilePrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeCreatePermanentPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeBackupPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeRestorePrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeShutdownPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeDebugPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeAuditPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeSystemEnvironmentPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeChangeNotifyPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeRemoteShutdownPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeUndockPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeSyncAgentPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeEnableDelegationPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeManageVolumePrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeImpersonatePrivilege 1788 GWWSM_V1.0.10.1114.exe Token: SeCreateGlobalPrivilege 1788 GWWSM_V1.0.10.1114.exe Token: 31 1788 GWWSM_V1.0.10.1114.exe Token: 32 1788 GWWSM_V1.0.10.1114.exe Token: 33 1788 GWWSM_V1.0.10.1114.exe Token: 34 1788 GWWSM_V1.0.10.1114.exe Token: 35 1788 GWWSM_V1.0.10.1114.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe 1788 GWWSM_V1.0.10.1114.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2992 wrote to memory of 1788 2992 wwsm.exe 85 PID 2992 wrote to memory of 1788 2992 wwsm.exe 85 PID 2992 wrote to memory of 1788 2992 wwsm.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\wwsm.exe"C:\Users\Admin\AppData\Local\Temp\wwsm.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\wwsm\GWWSM_V1.0.10.1114.exe"C:\Program Files (x86)\wwsm\GWWSM_V1.0.10.1114.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\wwsm\GWWSM_V1.0.10.1114.exe
- Size 1.7MB
- SHA256 edf73b5a0b60f5f33b97cc669b2448534202b787bc26a00e95283f7363b46ff5
- MD5 96b4d142d5aa5221e60300a8174cec11
- SHA1 fb15962b2c58945ec84692b0505cd50081ef452c
- SHA512 1dfee32c3460109018777aacaf43f9a2dbed1d80d8233ca94b6fc749cd2313fbce5fffc6893b997b83862bcbad3b16bc652ca945a40c02ee774159e514d83f47
- SSDEEP 49152:t+qK24dpXOR+zwWdUtjPSLXYjzijSAQfYhwAeB0hkCv6sYu:t+hp+RiwWdUtzAYnieAQQwAX4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\wwsm\ProcessToI.txt
- Size 9B
- SHA256 5c35e54657da946e7b575d82b26259436fd11c1a6d58f493dd173982c3014429
- MD5 07779f2c56c806cbb449f6406a8deac2
- SHA1 9299f9b0d83ec1d7116e36b41e5c4d147a22b0e0
- SHA512 30ed4b296b8aa6be542a30e7b8ffc6cbcb5da1d83123fae9d25429f9d0ea5d528334d8fae2c5c9426d09f7713731252779abc9e5718597a86804fe5183d84cf6
- MD5 SHA1 SHA512
- Path \??\c:\program files (x86)\wwsm\cwapi_32.dll
- Size 1.2MB
- SHA256 2f3731db8206df2f5023182257d8aa7069683745f97bb6af1c1e011ae8ddffb5
- MD5 aea774a789dc4eab8ecb13467c0a4245
- SHA1 8bdb1f0ade7011809b6d2f8fa5a5547fdf2a54b7
- SHA512 07ac5fee85a38ead7f8603a1b7ec40aacd1f95d6522af06ab8e7812717ffcedee73fb6ad5c726e706c45b52af2dd03ca4bc55fbd5a6ea2e6d766da8da6a533ce
- SSDEEP 24576:PNgbaQnOyKNqSkV3DTWx6eL0NBLkTBboPeJSpG1A4CIXnUGc7tSwRXGUWhUSblxL:FgaQIqS+DTWxjaLkTFoPCUGcosGUWhUM
- MD5 SHA1 SHA512 SSDEEP