Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 00:52

General

  • Target

    96615c080c85c00403039e5116876ba7614897e974424b58246beb99214c95b3.exe

  • Size

    134KB

  • MD5

    76032e1a2c6a0307274f5de8c21b4cbb

  • SHA1

    d6b8510eab61d712cb2f89c936ff79cb32eb5ec5

  • SHA256

    96615c080c85c00403039e5116876ba7614897e974424b58246beb99214c95b3

  • SHA512

    3928fde08dc9e71de650768fe1d99eaa60b01e795f9024bf672d10bcae60ac0c5031160059676b47976564f43580c354921b3ba44a63aa071806e1dcdfff990e

  • SSDEEP

    1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qv:riAyLN9aa+9U2rW1ip6pr2At7NZuQv

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96615c080c85c00403039e5116876ba7614897e974424b58246beb99214c95b3.exe
    "C:\Users\Admin\AppData\Local\Temp\96615c080c85c00403039e5116876ba7614897e974424b58246beb99214c95b3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:1508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Update\WwanSvc.exe

          Filesize

          134KB

          MD5

          cd82db61235bbfd857fab9a8232ec498

          SHA1

          aff7ae169ad9df51beb9e8a21a3e7e51509c503b

          SHA256

          a9910e9ba6aa7eac10ef72a1e5b6947335664d3efd104ecdef1fe8e2063f9d14

          SHA512

          609c652884116f60e2ebc7eaa1a948b55f97f4984f3b8e7dea8a61863c2f2d29f0f2ea614b8d1912716a0e335e38c3fcb2124c22b14dc24767d206a954d1ed0b

        • memory/1508-6-0x0000000000D50000-0x0000000000D78000-memory.dmp

          Filesize

          160KB

        • memory/4688-1-0x0000000000EE0000-0x0000000000F08000-memory.dmp

          Filesize

          160KB

        • memory/4688-5-0x0000000000EE0000-0x0000000000F08000-memory.dmp

          Filesize

          160KB