2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe
Size

134KB
MD5

32e8ff401a3dbb48bab981436056786b
SHA1

1be967378b64da45cf49113c34d7a133a2492998
SHA256

2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a
SHA512

8b74ea76c60c50dd79f6ed181bb40d07c14a592faf01e676756d3a00b73c49a187062ea1c89a60633f37822bbc4c1e22efe3686c4fff53358a31d9a6999c6ed7
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QE:riAyLN9aa+9U2rW1ip6pr2At7NZuQE

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2008-1-0x00000000011C0000-0x00000000011E8000-memory.dmp	UPX
behavioral1/files/0x0033000000015f6d-2.dat	UPX
behavioral1/memory/2616-7-0x0000000000150000-0x0000000000178000-memory.dmp	UPX
behavioral1/memory/2616-9-0x0000000000150000-0x0000000000178000-memory.dmp	UPX
behavioral1/memory/2008-10-0x00000000011C0000-0x00000000011E8000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2616	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2008	2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2008-1-0x00000000011C0000-0x00000000011E8000-memory.dmp	upx
behavioral1/files/0x0033000000015f6d-2.dat	upx
behavioral1/memory/2616-7-0x0000000000150000-0x0000000000178000-memory.dmp	upx
behavioral1/memory/2616-9-0x0000000000150000-0x0000000000178000-memory.dmp	upx
behavioral1/memory/2008-10-0x00000000011C0000-0x00000000011E8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2616	2008	2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe	28
PID 2008 wrote to memory of 2616	2008	2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe	28
PID 2008 wrote to memory of 2616	2008	2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe	28
PID 2008 wrote to memory of 2616	2008	2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe	28

C:\Users\Admin\AppData\Local\Temp\2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe
"C:\Users\Admin\AppData\Local\Temp\2dd46639616b789e73d2215a07f8220b37656ec0051492f4c575c305bcd3dc9a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
9d75f58d9bcb1b6da5d5c411a322f811

SHA1
ff8faef5d30d26fbb28046b8845c10d914208391

SHA256
12c74f946e09d2085470580a9f1c012b88c3899bfed4685425cf861f31f3e33a

SHA512
1246b683721422f5133e7a192ccf52970b099ad9f64fdb88619fee5c79bf07dd88986f14e7baef28cb16093967976946076b6fcd9ede166049064d9bd9f050b2

Download Submit
memory/2008-1-0x00000000011C0000-0x00000000011E8000-memory.dmp

Filesize
160KB

Download
memory/2008-6-0x0000000000270000-0x0000000000298000-memory.dmp

Filesize
160KB

Download
memory/2008-8-0x0000000000270000-0x0000000000298000-memory.dmp

Filesize
160KB

Download
memory/2008-10-0x00000000011C0000-0x00000000011E8000-memory.dmp

Filesize
160KB

Download
memory/2616-7-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download
memory/2616-9-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads