b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe
Size

97KB
MD5

ddcf75b5eaa02db87a00085f6df355b8
SHA1

7f0abcd936e7e63feb2e697a413bb1155624c6d0
SHA256

b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c
SHA512

99160311832d695a6a05056cc04645c8cb2308f79558a3b340ea8f29949ea058117d8d7bea82c01e5b07df0ef59e46a7dccdd60bfc6f3dd611613d9d2db915eb
SSDEEP

1536:iF0AJzLopHG9aa+9qX3apJoAKWYr0vcioyjp2RXKTzRZICrWaGZh7i:iiApLN9aa+9U2EWyipjp2R6JJrWNZQ

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
452	WwanSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WwanSvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 452	4840	b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe	84
PID 4840 wrote to memory of 452	4840	b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe	84
PID 4840 wrote to memory of 452	4840	b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe	84

C:\Users\Admin\AppData\Local\Temp\b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe
"C:\Users\Admin\AppData\Local\Temp\b60a27b461a2f18f0d5ef2207d4936859835e7f75dc4bd15c898cc924cac905c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
97KB

MD5
bfe794ae450c75a025cd9d43f6fd0689

SHA1
df9ea21d386db4559ed6cadd23fbaa0b7b5efb8d

SHA256
f8d8be7b740684978a1b9620bc4ca1ff85863db91b7312000c17e521cb83d550

SHA512
6616668358b0586e8880ac2ac8fb61616ab747ba413ca2c50652c154e55046d52354f3fcb2dbfb6d443ff2abdcc94eb0415bb5b4182bdff1b5e076eb0d5e29c8

Download Submit
memory/452-6-0x00000000004A0000-0x00000000004BE000-memory.dmp

Filesize
120KB

Download
memory/452-7-0x00000000004A0000-0x00000000004BE000-memory.dmp

Filesize
120KB

Download
memory/4840-0-0x0000000000330000-0x000000000034E000-memory.dmp

Filesize
120KB

Download
memory/4840-5-0x0000000000330000-0x000000000034E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads