555154ac5847cff157f13cdcdc952d378c7c914e05d1cf5aff406e9c4aac8f5f

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7235c4081521daefb3ba386399112b4f.exe
Size

24KB
MD5

7235c4081521daefb3ba386399112b4f
SHA1

e3b014742ef42ac55c664210296d9a404a9bfeb7
SHA256

555154ac5847cff157f13cdcdc952d378c7c914e05d1cf5aff406e9c4aac8f5f
SHA512

d1f0e454d081cbe3b0abbbdf78bf3e5f5430295bb2e7f138c2edab362c2dc43cc521a61dc0e935d36d6b9f1e8a6a8a8f8fce50f4c10d993478b7e8faa6e00d82
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5W0:bGS+ZfbJiO8qYoAf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	7235c4081521daefb3ba386399112b4f.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	7235c4081521daefb3ba386399112b4f.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2768	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2648	ipconfig.exe
2940	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	2940	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	7235c4081521daefb3ba386399112b4f.exe
2980	7235c4081521daefb3ba386399112b4f.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2360	2980	7235c4081521daefb3ba386399112b4f.exe	27
PID 2980 wrote to memory of 2360	2980	7235c4081521daefb3ba386399112b4f.exe	27
PID 2980 wrote to memory of 2360	2980	7235c4081521daefb3ba386399112b4f.exe	27
PID 2980 wrote to memory of 2360	2980	7235c4081521daefb3ba386399112b4f.exe	27
PID 2360 wrote to memory of 2684	2360	cmd.exe	29
PID 2360 wrote to memory of 2684	2360	cmd.exe	29
PID 2360 wrote to memory of 2684	2360	cmd.exe	29
PID 2360 wrote to memory of 2684	2360	cmd.exe	29
PID 2360 wrote to memory of 2648	2360	cmd.exe	30
PID 2360 wrote to memory of 2648	2360	cmd.exe	30
PID 2360 wrote to memory of 2648	2360	cmd.exe	30
PID 2360 wrote to memory of 2648	2360	cmd.exe	30
PID 2360 wrote to memory of 2768	2360	cmd.exe	31
PID 2360 wrote to memory of 2768	2360	cmd.exe	31
PID 2360 wrote to memory of 2768	2360	cmd.exe	31
PID 2360 wrote to memory of 2768	2360	cmd.exe	31
PID 2360 wrote to memory of 2704	2360	cmd.exe	33
PID 2360 wrote to memory of 2704	2360	cmd.exe	33
PID 2360 wrote to memory of 2704	2360	cmd.exe	33
PID 2360 wrote to memory of 2704	2360	cmd.exe	33
PID 2704 wrote to memory of 1220	2704	net.exe	34
PID 2704 wrote to memory of 1220	2704	net.exe	34
PID 2704 wrote to memory of 1220	2704	net.exe	34
PID 2704 wrote to memory of 1220	2704	net.exe	34
PID 2360 wrote to memory of 2940	2360	cmd.exe	35
PID 2360 wrote to memory of 2940	2360	cmd.exe	35
PID 2360 wrote to memory of 2940	2360	cmd.exe	35
PID 2360 wrote to memory of 2940	2360	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\7235c4081521daefb3ba386399112b4f.exe
"C:\Users\Admin\AppData\Local\Temp\7235c4081521daefb3ba386399112b4f.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:1220
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
8dc672271de75b24b6194b0e0ebea759

SHA1
072e638f3d374be66c55ab605471868523abc8c7

SHA256
e48139e62ac71075afc76c5272bd109f204d87934d225efb594a6ae880db7f70

SHA512
d9fd64656848de919c25a292b5fa6614c3ea7855d17f9e1a6bced345018e806aa38bc36bae1d6eeefebe0f38f09be13185ec90b20ff58787e8ea029a29b0927b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads