Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 05:38
Static task
static1
Behavioral task
behavioral1
Sample
7235c4081521daefb3ba386399112b4f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7235c4081521daefb3ba386399112b4f.exe
Resource
win10v2004-20231215-en
General
-
Target
7235c4081521daefb3ba386399112b4f.exe
-
Size
24KB
-
MD5
7235c4081521daefb3ba386399112b4f
-
SHA1
e3b014742ef42ac55c664210296d9a404a9bfeb7
-
SHA256
555154ac5847cff157f13cdcdc952d378c7c914e05d1cf5aff406e9c4aac8f5f
-
SHA512
d1f0e454d081cbe3b0abbbdf78bf3e5f5430295bb2e7f138c2edab362c2dc43cc521a61dc0e935d36d6b9f1e8a6a8a8f8fce50f4c10d993478b7e8faa6e00d82
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5W0:bGS+ZfbJiO8qYoAf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 7235c4081521daefb3ba386399112b4f.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 7235c4081521daefb3ba386399112b4f.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2768 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2648 ipconfig.exe 2940 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2768 tasklist.exe Token: SeDebugPrivilege 2940 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2980 7235c4081521daefb3ba386399112b4f.exe 2980 7235c4081521daefb3ba386399112b4f.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2360 2980 7235c4081521daefb3ba386399112b4f.exe 27 PID 2980 wrote to memory of 2360 2980 7235c4081521daefb3ba386399112b4f.exe 27 PID 2980 wrote to memory of 2360 2980 7235c4081521daefb3ba386399112b4f.exe 27 PID 2980 wrote to memory of 2360 2980 7235c4081521daefb3ba386399112b4f.exe 27 PID 2360 wrote to memory of 2684 2360 cmd.exe 29 PID 2360 wrote to memory of 2684 2360 cmd.exe 29 PID 2360 wrote to memory of 2684 2360 cmd.exe 29 PID 2360 wrote to memory of 2684 2360 cmd.exe 29 PID 2360 wrote to memory of 2648 2360 cmd.exe 30 PID 2360 wrote to memory of 2648 2360 cmd.exe 30 PID 2360 wrote to memory of 2648 2360 cmd.exe 30 PID 2360 wrote to memory of 2648 2360 cmd.exe 30 PID 2360 wrote to memory of 2768 2360 cmd.exe 31 PID 2360 wrote to memory of 2768 2360 cmd.exe 31 PID 2360 wrote to memory of 2768 2360 cmd.exe 31 PID 2360 wrote to memory of 2768 2360 cmd.exe 31 PID 2360 wrote to memory of 2704 2360 cmd.exe 33 PID 2360 wrote to memory of 2704 2360 cmd.exe 33 PID 2360 wrote to memory of 2704 2360 cmd.exe 33 PID 2360 wrote to memory of 2704 2360 cmd.exe 33 PID 2704 wrote to memory of 1220 2704 net.exe 34 PID 2704 wrote to memory of 1220 2704 net.exe 34 PID 2704 wrote to memory of 1220 2704 net.exe 34 PID 2704 wrote to memory of 1220 2704 net.exe 34 PID 2360 wrote to memory of 2940 2360 cmd.exe 35 PID 2360 wrote to memory of 2940 2360 cmd.exe 35 PID 2360 wrote to memory of 2940 2360 cmd.exe 35 PID 2360 wrote to memory of 2940 2360 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\7235c4081521daefb3ba386399112b4f.exe"C:\Users\Admin\AppData\Local\Temp\7235c4081521daefb3ba386399112b4f.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2684
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2648
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:1220
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD58dc672271de75b24b6194b0e0ebea759
SHA1072e638f3d374be66c55ab605471868523abc8c7
SHA256e48139e62ac71075afc76c5272bd109f204d87934d225efb594a6ae880db7f70
SHA512d9fd64656848de919c25a292b5fa6614c3ea7855d17f9e1a6bced345018e806aa38bc36bae1d6eeefebe0f38f09be13185ec90b20ff58787e8ea029a29b0927b