7c495f28243ce98ad67bf7e3c07a5efc9e9c576aa43fc6e6730addfc9335fe02

Analysis

max time kernel
175s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cb89f98dc505ee48f94f074861055b2.exe
Size

24KB
MD5

2cb89f98dc505ee48f94f074861055b2
SHA1

7739cc19ea8b53fd5a03e0695d0e07867b781b12
SHA256

7c495f28243ce98ad67bf7e3c07a5efc9e9c576aa43fc6e6730addfc9335fe02
SHA512

08aed6e52937434a93b488e698dbfd09bf7eab31252279d428031a4e94085f926977b818b8680efe7a60f488e4f1963535a7a3bcef37af2fa25fac2a50d93be8
SSDEEP

384:E3eVES+/xwGkRKJMDylM61qmTTMVF9/q5n0:bGS+ZfbJMDyO8qYoA0

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2cb89f98dc505ee48f94f074861055b2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2cb89f98dc505ee48f94f074861055b2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4068	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
808	ipconfig.exe
2468	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	2468	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4360	2cb89f98dc505ee48f94f074861055b2.exe
4360	2cb89f98dc505ee48f94f074861055b2.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1732	4360	2cb89f98dc505ee48f94f074861055b2.exe	93
PID 4360 wrote to memory of 1732	4360	2cb89f98dc505ee48f94f074861055b2.exe	93
PID 4360 wrote to memory of 1732	4360	2cb89f98dc505ee48f94f074861055b2.exe	93
PID 1732 wrote to memory of 4080	1732	cmd.exe	95
PID 1732 wrote to memory of 4080	1732	cmd.exe	95
PID 1732 wrote to memory of 4080	1732	cmd.exe	95
PID 1732 wrote to memory of 808	1732	cmd.exe	94
PID 1732 wrote to memory of 808	1732	cmd.exe	94
PID 1732 wrote to memory of 808	1732	cmd.exe	94
PID 1732 wrote to memory of 4068	1732	cmd.exe	96
PID 1732 wrote to memory of 4068	1732	cmd.exe	96
PID 1732 wrote to memory of 4068	1732	cmd.exe	96
PID 1732 wrote to memory of 5080	1732	cmd.exe	97
PID 1732 wrote to memory of 5080	1732	cmd.exe	97
PID 1732 wrote to memory of 5080	1732	cmd.exe	97
PID 5080 wrote to memory of 4224	5080	net.exe	98
PID 5080 wrote to memory of 4224	5080	net.exe	98
PID 5080 wrote to memory of 4224	5080	net.exe	98
PID 1732 wrote to memory of 2468	1732	cmd.exe	99
PID 1732 wrote to memory of 2468	1732	cmd.exe	99
PID 1732 wrote to memory of 2468	1732	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2cb89f98dc505ee48f94f074861055b2.exe
"C:\Users\Admin\AppData\Local\Temp\2cb89f98dc505ee48f94f074861055b2.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:4224
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
36a1e5abbf7fac952c3d78dd3ff7155c

SHA1
a2497cbac9ef512bd670d1cbd545fca6d37a8b0a

SHA256
975b8bb56972ef8a098c5ced78b2c9640034a58a5a6fa6769f45d991276e4f5c

SHA512
2ea28cb910af9c8b9ae766749647879544cf53be4e2b2b49c1650ad8b0c9464b0e812b3397cf220f8fab685046aa4ae44c3e24cd6bb0da7e05bbb05b86f0f70a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads