cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe
Size

97KB
MD5

76a669618d75f23e7b039f6cb40e227e
SHA1

da3bc8af8a5b0ffb420c922c4e0bcc5779924a64
SHA256

cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996
SHA512

7263a4363917807004177f9dc8b810aef64127b122d6b18d0840460f367697c6cc68535a6205643846be09768304362662d22ee7ba066ef7dc08b24ba3603128
SSDEEP

1536:iF0AJzLopHG9aa+9qX3apJoAKWYr0vcioyjp2RXKTzRZICrWaGZh7N:iiApLN9aa+9U2EWyipjp2R6JJrWNZX

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2736	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2456	cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2736	2456	cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe	28
PID 2456 wrote to memory of 2736	2456	cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe	28
PID 2456 wrote to memory of 2736	2456	cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe	28
PID 2456 wrote to memory of 2736	2456	cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe	28

C:\Users\Admin\AppData\Local\Temp\cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe
"C:\Users\Admin\AppData\Local\Temp\cc500c6ffbb3129b7ac2236250e0ed0fead3af8d93956c5b280ca6b9e7d52996.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2456
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
97KB

MD5
fde11fd8a944b62c947a37460efbab71

SHA1
a3bcd805d7a4714f258ecd8caeabefce0b473ac2

SHA256
d4e2ab5427a28263a785cc716dc18a5fbd311e9b52a3fa40290c0a6c9feac2fb

SHA512
b215de06edc0cb68d8ea8aebda23218d0c7a955e3d6a795af763cc0efd1e6d2253f40e869f396a15dafb919683974ab8a225a3431cb2d4bd774b65a5a0766732

Download Submit
memory/2456-1-0x00000000002E0000-0x00000000002FE000-memory.dmp

Filesize
120KB

Download
memory/2456-6-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/2456-8-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/2456-10-0x00000000002E0000-0x00000000002FE000-memory.dmp

Filesize
120KB

Download
memory/2736-7-0x0000000000A50000-0x0000000000A6E000-memory.dmp

Filesize
120KB

Download
memory/2736-9-0x0000000000A50000-0x0000000000A6E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads