977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe
Size

94KB
MD5

8880174a462e5126087b90afb570f07c
SHA1

321f09060f7dbec6c4ca7ba033fd33846ef340ab
SHA256

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526
SHA512

99bd45a42a3504e4f604ff9287f6dccb5128bd22dfb64a75a55f031021580cbc7f8806b9b66452e517c84531042b731975d7627721bf60959723fe69e0ec4029
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7a:tiAyLN9qa+oEGrWViJSzIR6JJrWNZk

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WwanSvc.exe

pid process

1628 WwanSvc.exe
Loads dropped DLL 1 IoCs

Processes:

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

pid process

1600 977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

pid	process
1628	WwanSvc.exe

pid	process
1600	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

description	pid	process	target process
PID 1600 wrote to memory of 1628	1600	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe
PID 1600 wrote to memory of 1628	1600	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe
PID 1600 wrote to memory of 1628	1600	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe
PID 1600 wrote to memory of 1628	1600	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe

C:\Users\Admin\AppData\Local\Temp\977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe
"C:\Users\Admin\AppData\Local\Temp\977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1600

C:\ProgramData\Update\WwanSvc.exe
"C:\ProgramData\Update\WwanSvc.exe" /run
2⤵
- Executes dropped EXE
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe
Filesize
94KB

MD5
eeacc995991c9ba7fb7e4939b2f8786b

SHA1
cd11c660f62aa61e85a5bb768a6a3d395fa58c61

SHA256
308d827d3a89c26774dd1481801e4fc486c12c42955fd45f8601ec5e334ff514

SHA512
4e09a15d919db88634af18bae05f68c6ca1ccc4f270110627d7f24d419ffd941e808ee3a5e5291436816358e5c375ca9e428eb5fb710f1262f8abe1c4a479dde

Download Submit