7c495f28243ce98ad67bf7e3c07a5efc9e9c576aa43fc6e6730addfc9335fe02

Analysis

max time kernel
7s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:21

Target

2cb89f98dc505ee48f94f074861055b2.exe
Size

24KB
MD5

2cb89f98dc505ee48f94f074861055b2
SHA1

7739cc19ea8b53fd5a03e0695d0e07867b781b12
SHA256

7c495f28243ce98ad67bf7e3c07a5efc9e9c576aa43fc6e6730addfc9335fe02
SHA512

08aed6e52937434a93b488e698dbfd09bf7eab31252279d428031a4e94085f926977b818b8680efe7a60f488e4f1963535a7a3bcef37af2fa25fac2a50d93be8
SSDEEP

384:E3eVES+/xwGkRKJMDylM61qmTTMVF9/q5n0:bGS+ZfbJMDyO8qYoA0

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2cb89f98dc505ee48f94f074861055b2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2cb89f98dc505ee48f94f074861055b2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2864	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
2720	ipconfig.exe
832	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	tasklist.exe
Token: SeDebugPrivilege	832	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2268	2cb89f98dc505ee48f94f074861055b2.exe
2268	2cb89f98dc505ee48f94f074861055b2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2472	2268	2cb89f98dc505ee48f94f074861055b2.exe	25
PID 2268 wrote to memory of 2472	2268	2cb89f98dc505ee48f94f074861055b2.exe	25
PID 2268 wrote to memory of 2472	2268	2cb89f98dc505ee48f94f074861055b2.exe	25
PID 2268 wrote to memory of 2472	2268	2cb89f98dc505ee48f94f074861055b2.exe	25
PID 2472 wrote to memory of 2216	2472	cmd.exe	30
PID 2472 wrote to memory of 2216	2472	cmd.exe	30
PID 2472 wrote to memory of 2216	2472	cmd.exe	30
PID 2472 wrote to memory of 2216	2472	cmd.exe	30
PID 2472 wrote to memory of 2720	2472	cmd.exe	31
PID 2472 wrote to memory of 2720	2472	cmd.exe	31
PID 2472 wrote to memory of 2720	2472	cmd.exe	31
PID 2472 wrote to memory of 2720	2472	cmd.exe	31
PID 2472 wrote to memory of 2864	2472	cmd.exe	32
PID 2472 wrote to memory of 2864	2472	cmd.exe	32
PID 2472 wrote to memory of 2864	2472	cmd.exe	32
PID 2472 wrote to memory of 2864	2472	cmd.exe	32
PID 2472 wrote to memory of 2952	2472	cmd.exe	34
PID 2472 wrote to memory of 2952	2472	cmd.exe	34
PID 2472 wrote to memory of 2952	2472	cmd.exe	34
PID 2472 wrote to memory of 2952	2472	cmd.exe	34
PID 2952 wrote to memory of 2948	2952	net.exe	35
PID 2952 wrote to memory of 2948	2952	net.exe	35
PID 2952 wrote to memory of 2948	2952	net.exe	35
PID 2952 wrote to memory of 2948	2952	net.exe	35
PID 2472 wrote to memory of 832	2472	cmd.exe	36
PID 2472 wrote to memory of 832	2472	cmd.exe	36
PID 2472 wrote to memory of 832	2472	cmd.exe	36
PID 2472 wrote to memory of 832	2472	cmd.exe	36