91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe
Size

94KB
MD5

391caec545f98d8f25a3b7c67255228f
SHA1

250f3c12584261c7a824a40ba4d737f7b8ca82ce
SHA256

91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4
SHA512

3df9ff697132c080767876680cc07df71abf30c6af03cd78acdd9c6e91279828ee0d3771fa8162dd3525713764e3c148651daf7d00c3fff3c3241c2c6980fba1
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7wV:tiAyLN9qa+oEGrWViJSzIR6JJrWNZCV

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WwanSvc.exe

pid process

3012 WwanSvc.exe
Loads dropped DLL 1 IoCs

Processes:

91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe

pid process

2716 91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe

pid	process
3012	WwanSvc.exe

pid	process
2716	91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe

description	pid	process	target process
PID 2716 wrote to memory of 3012	2716	91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe	WwanSvc.exe
PID 2716 wrote to memory of 3012	2716	91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe	WwanSvc.exe
PID 2716 wrote to memory of 3012	2716	91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe	WwanSvc.exe
PID 2716 wrote to memory of 3012	2716	91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe	WwanSvc.exe

C:\Users\Admin\AppData\Local\Temp\91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe
"C:\Users\Admin\AppData\Local\Temp\91747e6ab95efe79251a63e61f173a9b8f6eb8141776b8009c958f6bc81a25b4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2716

C:\ProgramData\Update\WwanSvc.exe
"C:\ProgramData\Update\WwanSvc.exe" /run
2⤵
- Executes dropped EXE
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
94KB

MD5
6c3db7bc11d8053be90189038459ccdd

SHA1
42f6ec4d4fdc718b48f1635a137af04ad4815480

SHA256
b588bd724cfd8d671401f1696005bd4c48e79fd0bf915cec4851463e1b7fecc6

SHA512
4236b7a3ec5cd81642da18215071fa2332e814a6e51bf12bd4f8a3e78fed8fa1018adc341941157518de1fff816ed6eb2d99046d9106afe6351f0b1bd99b41b8

Download Submit