40ed9e0437a7578d13aa16145329361349ffe7a47eb69e30fed5d2bc0a387819

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6efd120ea6f443e2aef014dde0a1bdc4.exe
Size

24KB
MD5

6efd120ea6f443e2aef014dde0a1bdc4
SHA1

1315bad8f19baf169b4e5a83fc1f3941848fb569
SHA256

40ed9e0437a7578d13aa16145329361349ffe7a47eb69e30fed5d2bc0a387819
SHA512

c6bbe69aed907d0bc95900c5fe009699cd29a04d38a485ef16a7def2b335b34986ea864dce8827f69e3a41f2d769baf701b146ae57e8c7bc58d280ad7534a58b
SSDEEP

384:E3eVES+/xwGkRKJ2qKNSlM61qmTTMVF9/q5J0:bGS+ZfbJuNSO8qYoA2

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	6efd120ea6f443e2aef014dde0a1bdc4.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	6efd120ea6f443e2aef014dde0a1bdc4.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4780	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3496	ipconfig.exe
1224	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	tasklist.exe
Token: SeDebugPrivilege	1224	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	6efd120ea6f443e2aef014dde0a1bdc4.exe
1756	6efd120ea6f443e2aef014dde0a1bdc4.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 404	1756	6efd120ea6f443e2aef014dde0a1bdc4.exe	22
PID 1756 wrote to memory of 404	1756	6efd120ea6f443e2aef014dde0a1bdc4.exe	22
PID 1756 wrote to memory of 404	1756	6efd120ea6f443e2aef014dde0a1bdc4.exe	22
PID 404 wrote to memory of 4928	404	cmd.exe	23
PID 404 wrote to memory of 4928	404	cmd.exe	23
PID 404 wrote to memory of 4928	404	cmd.exe	23
PID 404 wrote to memory of 3496	404	cmd.exe	25
PID 404 wrote to memory of 3496	404	cmd.exe	25
PID 404 wrote to memory of 3496	404	cmd.exe	25
PID 404 wrote to memory of 4780	404	cmd.exe	26
PID 404 wrote to memory of 4780	404	cmd.exe	26
PID 404 wrote to memory of 4780	404	cmd.exe	26
PID 404 wrote to memory of 2516	404	cmd.exe	45
PID 404 wrote to memory of 2516	404	cmd.exe	45
PID 404 wrote to memory of 2516	404	cmd.exe	45
PID 2516 wrote to memory of 4976	2516	net.exe	47
PID 2516 wrote to memory of 4976	2516	net.exe	47
PID 2516 wrote to memory of 4976	2516	net.exe	47
PID 404 wrote to memory of 1224	404	cmd.exe	46
PID 404 wrote to memory of 1224	404	cmd.exe	46
PID 404 wrote to memory of 1224	404	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\6efd120ea6f443e2aef014dde0a1bdc4.exe
"C:\Users\Admin\AppData\Local\Temp\6efd120ea6f443e2aef014dde0a1bdc4.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3496
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:4976
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
15KB

MD5
9e6cf3fd3f1a5c89df60326f0699033d

SHA1
8963ee5505698da70ba630661209ec68c9543512

SHA256
fdc6022443b5133993c98172bbb03604509850a545a95728a68603ad3e5d5a1a

SHA512
0d7e442b52848e6c11b3fccc32ac56cd847131d40a8e937bad981c4cf49b9ce23a596024c11793a6a37e6f00f25921ed084d1a0cd61312aaf075bbd73f4f8725

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads