977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe
Size

94KB
MD5

8880174a462e5126087b90afb570f07c
SHA1

321f09060f7dbec6c4ca7ba033fd33846ef340ab
SHA256

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526
SHA512

99bd45a42a3504e4f604ff9287f6dccb5128bd22dfb64a75a55f031021580cbc7f8806b9b66452e517c84531042b731975d7627721bf60959723fe69e0ec4029
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7a:tiAyLN9qa+oEGrWViJSzIR6JJrWNZk

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WwanSvc.exe

pid process

1040 WwanSvc.exe

pid	process
1040	WwanSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe

description	pid	process	target process
PID 868 wrote to memory of 1040	868	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe
PID 868 wrote to memory of 1040	868	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe
PID 868 wrote to memory of 1040	868	977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe	WwanSvc.exe

C:\Users\Admin\AppData\Local\Temp\977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe
"C:\Users\Admin\AppData\Local\Temp\977e19cd19c3968eeff735f154fd288696ed46b47124527401524f4ebeaa3526.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:868

C:\ProgramData\Update\WwanSvc.exe
"C:\ProgramData\Update\WwanSvc.exe" /run
2⤵
- Executes dropped EXE
PID:1040

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe
Filesize
94KB

MD5
9b35c899c135a19f46d95897dcfe594c

SHA1
b4f28074835d3d9781848fffd580449f2f428141

SHA256
d8832167b0b23237b8125efecfcc4add5d04e80b5b6de48c4826b6fa4c5f265b

SHA512
8b2ca5aefa4a274b6a15ee8f9d59fbe8c4a9755f2ed79df5230fdcc68072b3b8336c954daba6e42e2a9b9a4d7e677988d7024fb8b9c1576c918122798a6560e6

Download Submit