ff20a176f7ce2d9f0331d4410bf35700de96efa8ac4c435e5250736544f6973d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e0017f3872a5e0237dd1c065a71031f.exe
Size

24KB
MD5

0e0017f3872a5e0237dd1c065a71031f
SHA1

abb43eb3e4229f8cb7e6d20a07f9b97c0a40c3c5
SHA256

ff20a176f7ce2d9f0331d4410bf35700de96efa8ac4c435e5250736544f6973d
SHA512

5ae5afe3ec391ae273acadb28c55b470888724ce5c91b3be7878b44064ceb619aafdbb0118cda9ef476c74605f69111f987b5d29f30fb7e81b862460dda5a504
SSDEEP

384:E3eVES+/xwGkRKJqlM61qmTTMVF9/q590:bGS+ZfbJqO8qYoAy

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	0e0017f3872a5e0237dd1c065a71031f.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	0e0017f3872a5e0237dd1c065a71031f.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2312	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2268	ipconfig.exe
2632	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	tasklist.exe
Token: SeDebugPrivilege	2632	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	0e0017f3872a5e0237dd1c065a71031f.exe
3040	0e0017f3872a5e0237dd1c065a71031f.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2040	3040	0e0017f3872a5e0237dd1c065a71031f.exe	28
PID 3040 wrote to memory of 2040	3040	0e0017f3872a5e0237dd1c065a71031f.exe	28
PID 3040 wrote to memory of 2040	3040	0e0017f3872a5e0237dd1c065a71031f.exe	28
PID 3040 wrote to memory of 2040	3040	0e0017f3872a5e0237dd1c065a71031f.exe	28
PID 2040 wrote to memory of 2128	2040	cmd.exe	30
PID 2040 wrote to memory of 2128	2040	cmd.exe	30
PID 2040 wrote to memory of 2128	2040	cmd.exe	30
PID 2040 wrote to memory of 2128	2040	cmd.exe	30
PID 2040 wrote to memory of 2268	2040	cmd.exe	31
PID 2040 wrote to memory of 2268	2040	cmd.exe	31
PID 2040 wrote to memory of 2268	2040	cmd.exe	31
PID 2040 wrote to memory of 2268	2040	cmd.exe	31
PID 2040 wrote to memory of 2312	2040	cmd.exe	32
PID 2040 wrote to memory of 2312	2040	cmd.exe	32
PID 2040 wrote to memory of 2312	2040	cmd.exe	32
PID 2040 wrote to memory of 2312	2040	cmd.exe	32
PID 2040 wrote to memory of 2572	2040	cmd.exe	34
PID 2040 wrote to memory of 2572	2040	cmd.exe	34
PID 2040 wrote to memory of 2572	2040	cmd.exe	34
PID 2040 wrote to memory of 2572	2040	cmd.exe	34
PID 2572 wrote to memory of 2560	2572	net.exe	35
PID 2572 wrote to memory of 2560	2572	net.exe	35
PID 2572 wrote to memory of 2560	2572	net.exe	35
PID 2572 wrote to memory of 2560	2572	net.exe	35
PID 2040 wrote to memory of 2632	2040	cmd.exe	36
PID 2040 wrote to memory of 2632	2040	cmd.exe	36
PID 2040 wrote to memory of 2632	2040	cmd.exe	36
PID 2040 wrote to memory of 2632	2040	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\0e0017f3872a5e0237dd1c065a71031f.exe
"C:\Users\Admin\AppData\Local\Temp\0e0017f3872a5e0237dd1c065a71031f.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2560
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
f1667524b6f3d3583c8b2f8bbc2dbd8c

SHA1
ff7059ec35f1a6d2f425270711fcea72fe2014c7

SHA256
2a6aa1e85329aab3d815b37870e2aa1644d220ecd423df1d02e846f3af2a5b6d

SHA512
d9bf79b3e8e51301cf67490517dddf9531773383673d8a263fead7173c7a1bc920240aeaa8f7f5fd4b4baecf22ead5ba77cef4037663b727b2ae9006018741d6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads