76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de

Analysis

max time kernel
124s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe
Size

97KB
MD5

ad1d135bc03191645a08bfa68167688d
SHA1

75c63f29ac3ed9b553cf5a6b623706560227a856
SHA256

76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de
SHA512

8f2a8b34116e42ad3901fadc114e2f603e3d38c4750157544a2235a837ed9e7c61a9e6e2f2aeeb081bd69c30dfd8bf71015e27480f5214d0729b0bdb14cecbc3
SSDEEP

1536:iF0AJzLopHG9aa+9qX3apJoAKWYr0vcioyjp2RXKTzRZICrWaGZh7I:iiApLN9aa+9U2EWyipjp2R6JJrWNZq

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4688	WwanSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4688	1080	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	96
PID 1080 wrote to memory of 4688	1080	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	96
PID 1080 wrote to memory of 4688	1080	76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe	96

C:\Users\Admin\AppData\Local\Temp\76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe
"C:\Users\Admin\AppData\Local\Temp\76ce96ac04ec8365b67f84603030ed6efc89bc145f82ca6a9fe90374234be4de.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1080
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5148,i,39144156904280355,15417980039713258782,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
97KB

MD5
de73dd735d5043b004c9b69ba3127ecb

SHA1
068db756654e3189e805d367a154422b089c9acc

SHA256
5f420d22d040aee268a37f0f7be63f947e0e07f1784ed8e8f8e759a034f3d7d9

SHA512
a6be49beb884cc825f905d39821283fba7ca194608209e468277514a23e416a7294a37fe79f6ff02273b1dbdf49dd895c2b3d280afb1d48e5e33325acc76c10d

Download Submit
memory/1080-0-0x0000000000220000-0x000000000023E000-memory.dmp

Filesize
120KB

Download
memory/1080-5-0x0000000000220000-0x000000000023E000-memory.dmp

Filesize
120KB

Download
memory/4688-6-0x0000000000300000-0x000000000031E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads