f8737e898828d998a4c5949e2b3dad30d2ccf412ebd3eb1000aab178612b476e

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09a715ce0d997db0c866dd8452139956.exe
Size

24KB
MD5

09a715ce0d997db0c866dd8452139956
SHA1

819f9c0784c507cec9655dfe0c5bc837ad70d9ca
SHA256

f8737e898828d998a4c5949e2b3dad30d2ccf412ebd3eb1000aab178612b476e
SHA512

62f3c8bd5d15e7efebf2ee3cb23c3546b9b45d03fa6be2d2ac0329f24bf08a4307e9eaf584ada83e7476429f9a248d503c78f6da55035eeea8ba73bf08e5efb6
SSDEEP

384:E3eVES+/xwGkRKJHlM61qmTTMVF9/q5s0:bGS+ZfbJHO8qYoA9

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	09a715ce0d997db0c866dd8452139956.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	09a715ce0d997db0c866dd8452139956.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2676	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2284	ipconfig.exe
2936	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	tasklist.exe
Token: SeDebugPrivilege	2936	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2172	09a715ce0d997db0c866dd8452139956.exe
2172	09a715ce0d997db0c866dd8452139956.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1932	2172	09a715ce0d997db0c866dd8452139956.exe	28
PID 2172 wrote to memory of 1932	2172	09a715ce0d997db0c866dd8452139956.exe	28
PID 2172 wrote to memory of 1932	2172	09a715ce0d997db0c866dd8452139956.exe	28
PID 2172 wrote to memory of 1932	2172	09a715ce0d997db0c866dd8452139956.exe	28
PID 1932 wrote to memory of 2408	1932	cmd.exe	30
PID 1932 wrote to memory of 2408	1932	cmd.exe	30
PID 1932 wrote to memory of 2408	1932	cmd.exe	30
PID 1932 wrote to memory of 2408	1932	cmd.exe	30
PID 1932 wrote to memory of 2284	1932	cmd.exe	31
PID 1932 wrote to memory of 2284	1932	cmd.exe	31
PID 1932 wrote to memory of 2284	1932	cmd.exe	31
PID 1932 wrote to memory of 2284	1932	cmd.exe	31
PID 1932 wrote to memory of 2676	1932	cmd.exe	32
PID 1932 wrote to memory of 2676	1932	cmd.exe	32
PID 1932 wrote to memory of 2676	1932	cmd.exe	32
PID 1932 wrote to memory of 2676	1932	cmd.exe	32
PID 1932 wrote to memory of 2732	1932	cmd.exe	34
PID 1932 wrote to memory of 2732	1932	cmd.exe	34
PID 1932 wrote to memory of 2732	1932	cmd.exe	34
PID 1932 wrote to memory of 2732	1932	cmd.exe	34
PID 2732 wrote to memory of 2604	2732	net.exe	35
PID 2732 wrote to memory of 2604	2732	net.exe	35
PID 2732 wrote to memory of 2604	2732	net.exe	35
PID 2732 wrote to memory of 2604	2732	net.exe	35
PID 1932 wrote to memory of 2936	1932	cmd.exe	36
PID 1932 wrote to memory of 2936	1932	cmd.exe	36
PID 1932 wrote to memory of 2936	1932	cmd.exe	36
PID 1932 wrote to memory of 2936	1932	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\09a715ce0d997db0c866dd8452139956.exe
"C:\Users\Admin\AppData\Local\Temp\09a715ce0d997db0c866dd8452139956.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2284
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2604
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
cede956ae64e191225dceddcaa612c47

SHA1
5a89bb3796c21e119d71de9e6a7349471d068ed9

SHA256
6a5e1b83a91707ba5de0a7c3b6923d392a0980fb3c92323f6b8038c7283c6a05

SHA512
c0fcd631d52dff52ebb94469d9738edc83f12b2c81f3362f6899d0ec5ef2cf1f88664c19fc71f78f60d939f3e69adba65efa5f715fbd91194386afc8a330cbc8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads