648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe
Size

134KB
MD5

aeaf8f0bd5f96f4f9c3ba4d6a699e11c
SHA1

f4af06d33b5fb9c4658b16a55d1fc2cb7f830b29
SHA256

648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d
SHA512

571e4c921833596658f01c869080b312ab0327770c47573b22220a80bc89b7824a6023a8ac8866a3532f456bc9af3e7d3344bd3403ae8e62b054aefce390c0b1
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QF:riAyLN9aa+9U2rW1ip6pr2At7NZuQF

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/740-0-0x0000000000290000-0x00000000002B8000-memory.dmp	UPX
C:\ProgramData\Update\WwanSvc.exe	UPX
behavioral2/memory/740-4-0x0000000000290000-0x00000000002B8000-memory.dmp	UPX
behavioral2/memory/2544-6-0x0000000000960000-0x0000000000988000-memory.dmp	UPX
behavioral2/memory/2544-7-0x0000000000960000-0x0000000000988000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

WwanSvc.exe

pid process

2544 WwanSvc.exe

pid	process
2544	WwanSvc.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/740-0-0x0000000000290000-0x00000000002B8000-memory.dmp	upx
C:\ProgramData\Update\WwanSvc.exe	upx
behavioral2/memory/740-4-0x0000000000290000-0x00000000002B8000-memory.dmp	upx
behavioral2/memory/2544-6-0x0000000000960000-0x0000000000988000-memory.dmp	upx
behavioral2/memory/2544-7-0x0000000000960000-0x0000000000988000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe

description	pid	process	target process
PID 740 wrote to memory of 2544	740	648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe	WwanSvc.exe
PID 740 wrote to memory of 2544	740	648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe	WwanSvc.exe
PID 740 wrote to memory of 2544	740	648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe	WwanSvc.exe

C:\Users\Admin\AppData\Local\Temp\648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe
"C:\Users\Admin\AppData\Local\Temp\648af475c6a7dcf69d7161040fd53e4880e81c1c2846927087057b3dbdb6393d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:740
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
f20b7bf5c73a564eed5fe50787b1c0cc

SHA1
8cfd7eccb51da6815d514fa6610a62b8782291b4

SHA256
70270173ba7771f4abd11337862d4f92295c2b688c280afe00e9623b58268b33

SHA512
e0db77985d33ab36f41d64978f527bd8c7b3d21da84b6f2ccae8cd4d3025100db0576ecb50412bcb23f6d69076ca44c7d1545612b1bbab3b12174e535c1437bb

Download Submit
memory/740-0-0x0000000000290000-0x00000000002B8000-memory.dmp

Filesize
160KB

Download
memory/740-4-0x0000000000290000-0x00000000002B8000-memory.dmp

Filesize
160KB

Download
memory/2544-6-0x0000000000960000-0x0000000000988000-memory.dmp

Filesize
160KB

Download
memory/2544-7-0x0000000000960000-0x0000000000988000-memory.dmp

Filesize
160KB

Download