05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe
Size

134KB
MD5

1a9747c328a56e8cd2e5c029d53d92e3
SHA1

33615fcc1d7ccc4d89b1f73d70f321202f9b9911
SHA256

05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f
SHA512

e711506a6eeddffbe683dc50417d5acb29d7d0443f07c32cc477ab9a60904e796fab0a582c0f41f33a7517dc949ad3edc2fd97d9dd6afbf35ba2b046d1d0b183
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QU:riAyLN9aa+9U2rW1ip6pr2At7NZuQU

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2024-0-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	UPX
behavioral1/files/0x000b0000000133b9-2.dat	UPX
behavioral1/memory/2024-4-0x00000000000F0000-0x0000000000118000-memory.dmp	UPX
behavioral1/memory/2852-7-0x0000000000310000-0x0000000000338000-memory.dmp	UPX
behavioral1/memory/2024-8-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	UPX
behavioral1/memory/2024-9-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2852	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2024	05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2024-0-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	upx
behavioral1/files/0x000b0000000133b9-2.dat	upx
behavioral1/memory/2024-4-0x00000000000F0000-0x0000000000118000-memory.dmp	upx
behavioral1/memory/2852-7-0x0000000000310000-0x0000000000338000-memory.dmp	upx
behavioral1/memory/2024-8-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	upx
behavioral1/memory/2024-9-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2852	2024	05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe	28
PID 2024 wrote to memory of 2852	2024	05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe	28
PID 2024 wrote to memory of 2852	2024	05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe	28
PID 2024 wrote to memory of 2852	2024	05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe	28

C:\Users\Admin\AppData\Local\Temp\05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe
"C:\Users\Admin\AppData\Local\Temp\05535ac88bc3c48f0747435a9feb93e12524268f5bb6bf2ccf73edf7c12dc33f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2024
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
c1198b3617fdffa18698186246fea558

SHA1
c00a1632ffefe74b189904d73fce1fc804e00400

SHA256
f0ba6e1a517dd1033df39062e6cfdef38eeff3de6c9c945d733318f8e5174d04

SHA512
4a1fa94293134abd1b2c31ddb6976123d9a4789e607f629375b70ca339f5a69785842ddb3e1a1241e92e00f43f991c1da94cf31fd4d22e044c1dfc83c8f18b74

Download Submit
memory/2024-0-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2024-4-0x00000000000F0000-0x0000000000118000-memory.dmp

Filesize
160KB

Download
memory/2024-8-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2024-9-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2852-7-0x0000000000310000-0x0000000000338000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads