99ee102c59255bf574919f34e14e8a45a155d1e0f7f26b7aeb7df9bbaaf6ccf4

Analysis

max time kernel
142s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:06

Target

452307baa936693407ac9b8162f0d653.exe
Size

24KB
MD5

452307baa936693407ac9b8162f0d653
SHA1

b895feab1ba33b678fedad757f9f29ea68a44cd6
SHA256

99ee102c59255bf574919f34e14e8a45a155d1e0f7f26b7aeb7df9bbaaf6ccf4
SHA512

3658f90c89c4c0ebce98b3de579c410abeeb85133baee14473c492761cd25c5ef69a5d3728126029cdcb08236f090833f4a8293fe6cdd9bfdcbf4ec934011a8d
SSDEEP

384:E3eVES+/xwGkRKJklM61qmTTMVF9/q5G0:bGS+ZfbJkO8qYoAv

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	452307baa936693407ac9b8162f0d653.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	452307baa936693407ac9b8162f0d653.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
1544	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
3464	ipconfig.exe
4184	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	tasklist.exe
Token: SeDebugPrivilege	4184	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	452307baa936693407ac9b8162f0d653.exe
2660	452307baa936693407ac9b8162f0d653.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2968	2660	452307baa936693407ac9b8162f0d653.exe	34
PID 2660 wrote to memory of 2968	2660	452307baa936693407ac9b8162f0d653.exe	34
PID 2660 wrote to memory of 2968	2660	452307baa936693407ac9b8162f0d653.exe	34
PID 2968 wrote to memory of 1300	2968	cmd.exe	40
PID 2968 wrote to memory of 1300	2968	cmd.exe	40
PID 2968 wrote to memory of 1300	2968	cmd.exe	40
PID 2968 wrote to memory of 3464	2968	cmd.exe	42
PID 2968 wrote to memory of 3464	2968	cmd.exe	42
PID 2968 wrote to memory of 3464	2968	cmd.exe	42
PID 2968 wrote to memory of 1544	2968	cmd.exe	45
PID 2968 wrote to memory of 1544	2968	cmd.exe	45
PID 2968 wrote to memory of 1544	2968	cmd.exe	45
PID 2968 wrote to memory of 2928	2968	cmd.exe	97
PID 2968 wrote to memory of 2928	2968	cmd.exe	97
PID 2968 wrote to memory of 2928	2968	cmd.exe	97
PID 2928 wrote to memory of 4540	2928	net.exe	99
PID 2928 wrote to memory of 4540	2928	net.exe	99
PID 2928 wrote to memory of 4540	2928	net.exe	99
PID 2968 wrote to memory of 4184	2968	cmd.exe	98
PID 2968 wrote to memory of 4184	2968	cmd.exe	98
PID 2968 wrote to memory of 4184	2968	cmd.exe	98