76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe
Size

97KB
MD5

ad1d135bc03191645a08bfa68167688d
SHA1

75c63f29ac3ed9b553cf5a6b623706560227a856
SHA256

76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de
SHA512

8f2a8b34116e42ad3901fadc114e2f603e3d38c4750157544a2235a837ed9e7c61a9e6e2f2aeeb081bd69c30dfd8bf71015e27480f5214d0729b0bdb14cecbc3
SSDEEP

1536:iF0AJzLopHG9aa+9qX3apJoAKWYr0vcioyjp2RXKTzRZICrWaGZh7I:iiApLN9aa+9U2EWyipjp2R6JJrWNZq

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2620	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2620	2320	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	28
PID 2320 wrote to memory of 2620	2320	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	28
PID 2320 wrote to memory of 2620	2320	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	28
PID 2320 wrote to memory of 2620	2320	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	28

C:\Users\Admin\AppData\Local\Temp\76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe
"C:\Users\Admin\AppData\Local\Temp\76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
97KB

MD5
b5e1b3ef212fd9fd21591872e4d2e5e6

SHA1
597884cbbe525ac31dce20b63f459074d7f7c386

SHA256
e6720f7c1f44d4e48ced7103a1b89786ff04be6fbdb1b5f64990b6e8cd4e8553

SHA512
f9dc3fb78bce2d234d1aff2a884dba19c4524909301c73d0b840a1ec88e4e8ac91cfdd87401dcfcc6fd148ccb6b77ebfe04e381a393311626bef975a84ce7772

Download Submit
memory/2320-0-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download
memory/2320-4-0x0000000000140000-0x000000000015E000-memory.dmp

Filesize
120KB

Download
memory/2320-8-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download
memory/2320-9-0x0000000000140000-0x000000000015E000-memory.dmp

Filesize
120KB

Download
memory/2320-10-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download
memory/2620-7-0x0000000001250000-0x000000000126E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads