8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe
Size

94KB
MD5

7afd2e97348f8c0d00a50f0036650a37
SHA1

a430610ed09b9a76fb2f3fe5c30097ddc58d91f3
SHA256

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822
SHA512

01f347caa4f6907530ea953af26ca2607fb2fc332e3d8eb3e7f41b76137f87b5c1f8ee2427c2f0dc3ece210b4a0a0736f9d5596fd36599c898f568f45e3fb020
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7O:tiAyLN9qa+oEGrWViJSzIR6JJrWNZE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WwanSvc.exe

pid process

2012 WwanSvc.exe
Loads dropped DLL 1 IoCs

Processes:

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

pid process

1704 8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

pid	process
2012	WwanSvc.exe

pid	process
1704	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

description	pid	process	target process
PID 1704 wrote to memory of 2012	1704	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe
PID 1704 wrote to memory of 2012	1704	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe
PID 1704 wrote to memory of 2012	1704	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe
PID 1704 wrote to memory of 2012	1704	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe

C:\Users\Admin\AppData\Local\Temp\8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe
"C:\Users\Admin\AppData\Local\Temp\8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704

C:\ProgramData\Update\WwanSvc.exe
"C:\ProgramData\Update\WwanSvc.exe" /run
2⤵
- Executes dropped EXE
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
94KB

MD5
10b8df882c169da483476de75431602b

SHA1
f465f712d8b8d56208fc0810136441ed8ecb11a6

SHA256
bf38c28a8258ce1b2aa0dc8a9eb166b1825d18dd55745458321fdc1c7f14a3ba

SHA512
e97b6095de053e5ace192e80a0b21729dcdb15b6ecadced8afecfb88f332b72c31e20eeb276391a761d0df8702869cd626fc062442bc27192862f1a404ac0311

Download Submit