7f391c38887c02523f18ab5536e25d5053bae5354420bcd8b1d68020e6d547b5

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13bf9abb866f2693d4ed8a0186fa7be9.exe
Size

24KB
MD5

13bf9abb866f2693d4ed8a0186fa7be9
SHA1

908fda3d0fa91048962b0803edaec9afb1a86561
SHA256

7f391c38887c02523f18ab5536e25d5053bae5354420bcd8b1d68020e6d547b5
SHA512

fe93b0dee9a5db1e6a06f886c499d6b83a7ca94f3e2fe203b475918dabe3e2b87c9c04dcf8bac8de7925abda76d39b38f2dcadb9601391f5cbe8e966e936c978
SSDEEP

384:E3eVES+/xwGkRKJCYUuV6ovtlM61qmTTMVF9/q590:bGS+ZfbJL6o1O8qYoAy

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	13bf9abb866f2693d4ed8a0186fa7be9.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	13bf9abb866f2693d4ed8a0186fa7be9.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1932	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2728	NETSTAT.EXE
1184	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	2728	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	13bf9abb866f2693d4ed8a0186fa7be9.exe
2088	13bf9abb866f2693d4ed8a0186fa7be9.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2496	2088	13bf9abb866f2693d4ed8a0186fa7be9.exe	28
PID 2088 wrote to memory of 2496	2088	13bf9abb866f2693d4ed8a0186fa7be9.exe	28
PID 2088 wrote to memory of 2496	2088	13bf9abb866f2693d4ed8a0186fa7be9.exe	28
PID 2088 wrote to memory of 2496	2088	13bf9abb866f2693d4ed8a0186fa7be9.exe	28
PID 2496 wrote to memory of 2524	2496	cmd.exe	30
PID 2496 wrote to memory of 2524	2496	cmd.exe	30
PID 2496 wrote to memory of 2524	2496	cmd.exe	30
PID 2496 wrote to memory of 2524	2496	cmd.exe	30
PID 2496 wrote to memory of 1184	2496	cmd.exe	31
PID 2496 wrote to memory of 1184	2496	cmd.exe	31
PID 2496 wrote to memory of 1184	2496	cmd.exe	31
PID 2496 wrote to memory of 1184	2496	cmd.exe	31
PID 2496 wrote to memory of 1932	2496	cmd.exe	32
PID 2496 wrote to memory of 1932	2496	cmd.exe	32
PID 2496 wrote to memory of 1932	2496	cmd.exe	32
PID 2496 wrote to memory of 1932	2496	cmd.exe	32
PID 2496 wrote to memory of 1952	2496	cmd.exe	34
PID 2496 wrote to memory of 1952	2496	cmd.exe	34
PID 2496 wrote to memory of 1952	2496	cmd.exe	34
PID 2496 wrote to memory of 1952	2496	cmd.exe	34
PID 1952 wrote to memory of 2980	1952	net.exe	35
PID 1952 wrote to memory of 2980	1952	net.exe	35
PID 1952 wrote to memory of 2980	1952	net.exe	35
PID 1952 wrote to memory of 2980	1952	net.exe	35
PID 2496 wrote to memory of 2728	2496	cmd.exe	36
PID 2496 wrote to memory of 2728	2496	cmd.exe	36
PID 2496 wrote to memory of 2728	2496	cmd.exe	36
PID 2496 wrote to memory of 2728	2496	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\13bf9abb866f2693d4ed8a0186fa7be9.exe
"C:\Users\Admin\AppData\Local\Temp\13bf9abb866f2693d4ed8a0186fa7be9.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1184
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2980
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
fa9069309a45c5455e335dc3f48778b1

SHA1
470974bc306110ebfd200495818ccffaaaff557f

SHA256
8f87cfd5d3f42ce2e630c8539fb43cc9845748d9e703df7319baca36ab10c307

SHA512
5bef7e3de1ccf4ca04a4e0b11597df66d8b78ae502222d43a2eca2459681acecafcce9fb0ceee4f839df1ff04afaf2446236ef1d65b58351cd328adcfa2242a2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads