8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe
Size

94KB
MD5

7afd2e97348f8c0d00a50f0036650a37
SHA1

a430610ed09b9a76fb2f3fe5c30097ddc58d91f3
SHA256

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822
SHA512

01f347caa4f6907530ea953af26ca2607fb2fc332e3d8eb3e7f41b76137f87b5c1f8ee2427c2f0dc3ece210b4a0a0736f9d5596fd36599c898f568f45e3fb020
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7O:tiAyLN9qa+oEGrWViJSzIR6JJrWNZE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WwanSvc.exe

pid process

1896 WwanSvc.exe

pid	process
1896	WwanSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe

description	pid	process	target process
PID 3168 wrote to memory of 1896	3168	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe
PID 3168 wrote to memory of 1896	3168	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe
PID 3168 wrote to memory of 1896	3168	8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe	WwanSvc.exe

C:\Users\Admin\AppData\Local\Temp\8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe
"C:\Users\Admin\AppData\Local\Temp\8db8acad2b6ec933a7de5dd9569cc9f04b77f9ad804c2635dfa9c69daad3c822.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3168

C:\ProgramData\Update\WwanSvc.exe
"C:\ProgramData\Update\WwanSvc.exe" /run
2⤵
- Executes dropped EXE
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4400,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
94KB

MD5
e44a078823e3916fa849db56473d05a0

SHA1
90b18631028744dedc310c2fa0781a4988d24f4c

SHA256
0131ce9e32cc047d7af01998f3f1e9a82978e98ade014adb102cd84e2e8df8b7

SHA512
3ef8be67a67994b451f300353fd1d4f2a3a6864a8f95c4cd2477dc074cd0553ec75ea7dc38b53265ec9c8ac5f4e0896767bce10945734ab341e38bee8bf86c29

Download Submit