b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe
Size

134KB
MD5

de6e8cda4e35bba25f574a263d981441
SHA1

62806bfee00a6a3cee0a0d77b7b5f6595db58485
SHA256

b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83
SHA512

7b9d7d1ed4a0ff56a7b1578d7ac07430fc8511f4458eaac140f639e774a8cc96436f469e91be053091d1c86af37963154c1d5c950e26f54476adc833e25306a2
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qr:riAyLN9aa+9U2rW1ip6pr2At7NZuQr

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2140-4-0x0000000000130000-0x0000000000158000-memory.dmp	UPX
behavioral1/files/0x00350000000149d0-2.dat	UPX
behavioral1/memory/2140-1-0x0000000001280000-0x00000000012A8000-memory.dmp	UPX
behavioral1/memory/1712-7-0x0000000001320000-0x0000000001348000-memory.dmp	UPX
behavioral1/memory/2140-8-0x0000000001280000-0x00000000012A8000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1712	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2140	b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2140-4-0x0000000000130000-0x0000000000158000-memory.dmp	upx
behavioral1/files/0x00350000000149d0-2.dat	upx
behavioral1/memory/2140-1-0x0000000001280000-0x00000000012A8000-memory.dmp	upx
behavioral1/memory/1712-7-0x0000000001320000-0x0000000001348000-memory.dmp	upx
behavioral1/memory/2140-8-0x0000000001280000-0x00000000012A8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1712	2140	b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe	28
PID 2140 wrote to memory of 1712	2140	b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe	28
PID 2140 wrote to memory of 1712	2140	b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe	28
PID 2140 wrote to memory of 1712	2140	b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe	28

C:\Users\Admin\AppData\Local\Temp\b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe
"C:\Users\Admin\AppData\Local\Temp\b025c415518513b73eca723602daf5a92cc76c185d9329dbe50948d078360b83.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2140
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
0f4427d8e3f04b6d1b1415b7189304b2

SHA1
2c6b82313f6008e75a75964b25204ac45d4eba87

SHA256
a7bbe7a471c7c51000cb01948c44d0c4f49398e9074979df4d1f38cbafb96d88

SHA512
ba1aea45e952962adad6ce253d4383242c858257908ba4fc610e88d72cd86afecf41fa659c4ee1651a75030bca0ff62dadea102cca10a5c802a2f9932389633a

Download Submit
memory/1712-7-0x0000000001320000-0x0000000001348000-memory.dmp

Filesize
160KB

Download
memory/2140-4-0x0000000000130000-0x0000000000158000-memory.dmp

Filesize
160KB

Download
memory/2140-1-0x0000000001280000-0x00000000012A8000-memory.dmp

Filesize
160KB

Download
memory/2140-8-0x0000000001280000-0x00000000012A8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads