7863db9106429c5d4f7b474eb712ad8b54a22476f9b88af30b05c7c93ed0b12e

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 15:50

Target

NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe
Size

33KB
MD5

8e071e0a4c4363f3e2c3ac86c3b0beb0
SHA1

d0bf23075393c0a353d0f2ec3f6d9d0756328cf4
SHA256

7863db9106429c5d4f7b474eb712ad8b54a22476f9b88af30b05c7c93ed0b12e
SHA512

84bfbbe57567d75d2191d6951e3621716c7208f57d3da07d43735e5f9fed21d24e1b6a8bfba4377edecc77be9916a5b27e9f4b9d966a1c88eac25ac3d8550c97
SSDEEP

384:E3ZiES+/xwGkRKJilM61qmTTMVF9/q5Q0iKCxZECKCxZE:45S+ZfbJiO8qYoApiKC/ECKC/E

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
336	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
1848	ipconfig.exe
1972	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	336	tasklist.exe
Token: SeDebugPrivilege	1972	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1740	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe
1740	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 5044	1740	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe	87
PID 1740 wrote to memory of 5044	1740	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe	87
PID 1740 wrote to memory of 5044	1740	NEAS.8e071e0a4c4363f3e2c3ac86c3b0beb0.exe	87
PID 5044 wrote to memory of 5056	5044	cmd.exe	89
PID 5044 wrote to memory of 5056	5044	cmd.exe	89
PID 5044 wrote to memory of 5056	5044	cmd.exe	89
PID 5044 wrote to memory of 1848	5044	cmd.exe	90
PID 5044 wrote to memory of 1848	5044	cmd.exe	90
PID 5044 wrote to memory of 1848	5044	cmd.exe	90
PID 5044 wrote to memory of 336	5044	cmd.exe	92
PID 5044 wrote to memory of 336	5044	cmd.exe	92
PID 5044 wrote to memory of 336	5044	cmd.exe	92
PID 5044 wrote to memory of 784	5044	cmd.exe	95
PID 5044 wrote to memory of 784	5044	cmd.exe	95
PID 5044 wrote to memory of 784	5044	cmd.exe	95
PID 784 wrote to memory of 660	784	net.exe	96
PID 784 wrote to memory of 660	784	net.exe	96
PID 784 wrote to memory of 660	784	net.exe	96
PID 5044 wrote to memory of 1972	5044	cmd.exe	97
PID 5044 wrote to memory of 1972	5044	cmd.exe	97
PID 5044 wrote to memory of 1972	5044	cmd.exe	97