8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe
Size

134KB
MD5

cfc4deff54fcbae2c9eebcb69783076f
SHA1

386d51f12cb47e67171a50f53897e381f719e393
SHA256

8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e
SHA512

d79f0442fbd616f0cf1449b4f6644df72ce0ea611435adb790bd7269c7f7970677dd3a01ee60369fbd9f99193fe34e7dd32627af2fed5d6102f78d6a2c27a131
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qo:riAyLN9aa+9U2rW1ip6pr2At7NZuQo

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000F80000-0x0000000000FA8000-memory.dmp	UPX
behavioral1/memory/2196-4-0x0000000000C10000-0x0000000000C38000-memory.dmp	UPX
behavioral1/files/0x00300000000143fd-2.dat	UPX
behavioral1/memory/2196-7-0x0000000000F80000-0x0000000000FA8000-memory.dmp	UPX
behavioral1/memory/2096-8-0x0000000000C10000-0x0000000000C38000-memory.dmp	UPX
behavioral1/memory/2196-9-0x0000000000F80000-0x0000000000FA8000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2096	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000F80000-0x0000000000FA8000-memory.dmp	upx
behavioral1/memory/2196-4-0x0000000000C10000-0x0000000000C38000-memory.dmp	upx
behavioral1/files/0x00300000000143fd-2.dat	upx
behavioral1/memory/2196-7-0x0000000000F80000-0x0000000000FA8000-memory.dmp	upx
behavioral1/memory/2096-8-0x0000000000C10000-0x0000000000C38000-memory.dmp	upx
behavioral1/memory/2196-9-0x0000000000F80000-0x0000000000FA8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2096	2196	8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe	28
PID 2196 wrote to memory of 2096	2196	8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe	28
PID 2196 wrote to memory of 2096	2196	8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe	28
PID 2196 wrote to memory of 2096	2196	8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe	28

C:\Users\Admin\AppData\Local\Temp\8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe
"C:\Users\Admin\AppData\Local\Temp\8587936f393132fa1bc8174f8487eb1910713c11d513fe75c673fbb4623b402e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2196
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
d21bd775c622786eea4921a39e9ca9b3

SHA1
112b2e3d58e52f4f6e00a03225053f788ed6ec38

SHA256
4c111f010242e3cd5102a0ed8a42c4560762797dccf003d5562eafcfcee04977

SHA512
bb5b0c26ccda0d8a4ce2b720551db981677b6fe391a9aa35d911e71c39bb595122385448ed0c5f06b102ef8b6eb66809aaa94ee210520ac170de7bbb4b585381

Download Submit
memory/2096-8-0x0000000000C10000-0x0000000000C38000-memory.dmp

Filesize
160KB

Download
memory/2196-0-0x0000000000F80000-0x0000000000FA8000-memory.dmp

Filesize
160KB

Download
memory/2196-4-0x0000000000C10000-0x0000000000C38000-memory.dmp

Filesize
160KB

Download
memory/2196-7-0x0000000000F80000-0x0000000000FA8000-memory.dmp

Filesize
160KB

Download
memory/2196-9-0x0000000000F80000-0x0000000000FA8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads