67d18efa7038e9e651fc5c7a9caf87df2275562a7c6d431dc12e42fbb596cccc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

518d0a0ea961119a9403ee30137e599e.exe
Size

24KB
MD5

518d0a0ea961119a9403ee30137e599e
SHA1

f0f21dbe6353787cffe6964e9c44b3175a5fa8c0
SHA256

67d18efa7038e9e651fc5c7a9caf87df2275562a7c6d431dc12e42fbb596cccc
SHA512

9817289926ee983627d4c8f45f22ea6abea41bd19afe2d05bbac3637bc849ce7ab01347d7d2f68a798c4c22d6ccaf5b7f2d96ca5316ae081c3862b49f6e3e700
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5+gg0:bGS+ZfbJiO8qYoA+m

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	518d0a0ea961119a9403ee30137e599e.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	518d0a0ea961119a9403ee30137e599e.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2440	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2168	ipconfig.exe
4704	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	tasklist.exe
Token: SeDebugPrivilege	4704	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4692	518d0a0ea961119a9403ee30137e599e.exe
4692	518d0a0ea961119a9403ee30137e599e.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2484	4692	518d0a0ea961119a9403ee30137e599e.exe	32
PID 4692 wrote to memory of 2484	4692	518d0a0ea961119a9403ee30137e599e.exe	32
PID 4692 wrote to memory of 2484	4692	518d0a0ea961119a9403ee30137e599e.exe	32
PID 2484 wrote to memory of 4272	2484	cmd.exe	22
PID 2484 wrote to memory of 4272	2484	cmd.exe	22
PID 2484 wrote to memory of 4272	2484	cmd.exe	22
PID 2484 wrote to memory of 2168	2484	cmd.exe	23
PID 2484 wrote to memory of 2168	2484	cmd.exe	23
PID 2484 wrote to memory of 2168	2484	cmd.exe	23
PID 2484 wrote to memory of 2440	2484	cmd.exe	24
PID 2484 wrote to memory of 2440	2484	cmd.exe	24
PID 2484 wrote to memory of 2440	2484	cmd.exe	24
PID 2484 wrote to memory of 3412	2484	cmd.exe	28
PID 2484 wrote to memory of 3412	2484	cmd.exe	28
PID 2484 wrote to memory of 3412	2484	cmd.exe	28
PID 3412 wrote to memory of 3480	3412	net.exe	30
PID 3412 wrote to memory of 3480	3412	net.exe	30
PID 3412 wrote to memory of 3480	3412	net.exe	30
PID 2484 wrote to memory of 4704	2484	cmd.exe	29
PID 2484 wrote to memory of 4704	2484	cmd.exe	29
PID 2484 wrote to memory of 4704	2484	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\518d0a0ea961119a9403ee30137e599e.exe
"C:\Users\Admin\AppData\Local\Temp\518d0a0ea961119a9403ee30137e599e.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd /c set
1⤵
PID:4272

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
1⤵
- Gathers network information
PID:2168

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\SysWOW64\net.exe
net start
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\net1.exe
  C:\Windows\system32\net1 start
  2⤵
  PID:3480

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -an
1⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
15KB

MD5
8c8e31c9d449ef275553d12cfc38b95e

SHA1
3f11223419f55dc3b17633475fed4d1c5a0a6b64

SHA256
5c0ecae12a269e04e13d4de27e04762f5b53b6274ceaf11e7ef006825b3e38be

SHA512
6d3b10e9698e99dfc76042eaec489579c309b95e988407f4f0b6540b83ff51268e3cec6f34d4f70b2e51dd3fccc1559b3772c6a6bf2ba1a677371825cb5a3819

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads