0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe
Size

134KB
MD5

6280221a0f3080d5d18248ab2d134cdb
SHA1

fbc09d143e1a1a728b3747c64c4e2a7ec2d2d526
SHA256

0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87
SHA512

0bbc82e3a7de0e8f7f4f8f1efa7b8011eb89aa35cc65ceaec86615f1dda58050a585b254b2ce86e21e4088d29250671c8366e2f255dec9f0e0ff7e3e7a74ebe8
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QF:riAyLN9aa+9U2rW1ip6pr2At7NZuQF

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/1096-0-0x0000000001110000-0x0000000001138000-memory.dmp	UPX
behavioral1/files/0x003500000001567f-2.dat	UPX
behavioral1/memory/1260-6-0x0000000000BE0000-0x0000000000C08000-memory.dmp	UPX
behavioral1/memory/1096-7-0x0000000001110000-0x0000000001138000-memory.dmp	UPX
behavioral1/memory/1260-9-0x0000000000BE0000-0x0000000000C08000-memory.dmp	UPX
behavioral1/memory/1096-10-0x0000000001110000-0x0000000001138000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1260	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
1096	0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1096-0-0x0000000001110000-0x0000000001138000-memory.dmp	upx
behavioral1/files/0x003500000001567f-2.dat	upx
behavioral1/memory/1260-6-0x0000000000BE0000-0x0000000000C08000-memory.dmp	upx
behavioral1/memory/1096-7-0x0000000001110000-0x0000000001138000-memory.dmp	upx
behavioral1/memory/1260-9-0x0000000000BE0000-0x0000000000C08000-memory.dmp	upx
behavioral1/memory/1096-10-0x0000000001110000-0x0000000001138000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1260	1096	0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe	28
PID 1096 wrote to memory of 1260	1096	0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe	28
PID 1096 wrote to memory of 1260	1096	0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe	28
PID 1096 wrote to memory of 1260	1096	0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe	28

C:\Users\Admin\AppData\Local\Temp\0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe
"C:\Users\Admin\AppData\Local\Temp\0f5cfd42a6cf35eaa97ed75b250f3b3ef848fce7e82d2c720d8f7d8fe011bf87.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1096
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
1d5c817d8b3edc5bfd32b7a7ac984b13

SHA1
de15b6f53b695e9d4b619f974e1c44fa620e7206

SHA256
d6b92e305546c09fb05e0879bf5315a352b3c087e31a20741740aa51f85405f8

SHA512
977a127078384ed75a0e2c1746649f23096f469241875bda739067695aa65cd08df11449be5b9ff75eb64c3daf2f459b510eaa7a6dcd15df99c59e1cfbfe986f

Download Submit
memory/1096-0-0x0000000001110000-0x0000000001138000-memory.dmp

Filesize
160KB

Download
memory/1096-7-0x0000000001110000-0x0000000001138000-memory.dmp

Filesize
160KB

Download
memory/1096-8-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download
memory/1096-10-0x0000000001110000-0x0000000001138000-memory.dmp

Filesize
160KB

Download
memory/1260-6-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download
memory/1260-9-0x0000000000BE0000-0x0000000000C08000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads