51a1c367b0dc28f89689a4a4493c02844e60070f6b19aef3a8cd16534752ba77

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c7bfc8245f46c83ba80f54f9a06b32f.exe
Size

24KB
MD5

5c7bfc8245f46c83ba80f54f9a06b32f
SHA1

52cb19a98ce979438645ea9fb8e5dfe1a4b5d197
SHA256

51a1c367b0dc28f89689a4a4493c02844e60070f6b19aef3a8cd16534752ba77
SHA512

265a59b600841e09e61775840a22a53e5025b475bc408ea7590cad928acf77ddea3443aa19a58a159e4190771278013fc6d83f80c7182733c61c8b46443d06a2
SSDEEP

384:E3eVES+/xwGkRKJHYQRlM61qmTTMVF9/q510:bGS+ZfbJHYIO8qYoAa

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	5c7bfc8245f46c83ba80f54f9a06b32f.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	5c7bfc8245f46c83ba80f54f9a06b32f.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2176	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2620	NETSTAT.EXE
3052	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	tasklist.exe
Token: SeDebugPrivilege	2620	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2552	5c7bfc8245f46c83ba80f54f9a06b32f.exe
2552	5c7bfc8245f46c83ba80f54f9a06b32f.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3020	2552	5c7bfc8245f46c83ba80f54f9a06b32f.exe	16
PID 2552 wrote to memory of 3020	2552	5c7bfc8245f46c83ba80f54f9a06b32f.exe	16
PID 2552 wrote to memory of 3020	2552	5c7bfc8245f46c83ba80f54f9a06b32f.exe	16
PID 2552 wrote to memory of 3020	2552	5c7bfc8245f46c83ba80f54f9a06b32f.exe	16
PID 3020 wrote to memory of 3040	3020	cmd.exe	23
PID 3020 wrote to memory of 3040	3020	cmd.exe	23
PID 3020 wrote to memory of 3040	3020	cmd.exe	23
PID 3020 wrote to memory of 3040	3020	cmd.exe	23
PID 3020 wrote to memory of 3052	3020	cmd.exe	17
PID 3020 wrote to memory of 3052	3020	cmd.exe	17
PID 3020 wrote to memory of 3052	3020	cmd.exe	17
PID 3020 wrote to memory of 3052	3020	cmd.exe	17
PID 3020 wrote to memory of 2176	3020	cmd.exe	18
PID 3020 wrote to memory of 2176	3020	cmd.exe	18
PID 3020 wrote to memory of 2176	3020	cmd.exe	18
PID 3020 wrote to memory of 2176	3020	cmd.exe	18
PID 3020 wrote to memory of 2688	3020	cmd.exe	22
PID 3020 wrote to memory of 2688	3020	cmd.exe	22
PID 3020 wrote to memory of 2688	3020	cmd.exe	22
PID 3020 wrote to memory of 2688	3020	cmd.exe	22
PID 2688 wrote to memory of 2692	2688	net.exe	20
PID 2688 wrote to memory of 2692	2688	net.exe	20
PID 2688 wrote to memory of 2692	2688	net.exe	20
PID 2688 wrote to memory of 2692	2688	net.exe	20
PID 3020 wrote to memory of 2620	3020	cmd.exe	21
PID 3020 wrote to memory of 2620	3020	cmd.exe	21
PID 3020 wrote to memory of 2620	3020	cmd.exe	21
PID 3020 wrote to memory of 2620	3020	cmd.exe	21

C:\Users\Admin\AppData\Local\Temp\5c7bfc8245f46c83ba80f54f9a06b32f.exe
"C:\Users\Admin\AppData\Local\Temp\5c7bfc8245f46c83ba80f54f9a06b32f.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3052
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:3040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
ddde0c2cc94160a695bd7ef7f2fbd920

SHA1
dc9aad6f91214f4446088bc4e9e159f5edd2bbff

SHA256
320e5e073388cf0fe2f16c7f2751e0f62003c67dd3ead229830b84fcd6564cc5

SHA512
b9ef790904a3312e1cfdac9b4e8011d48c21c1116dafdda2c5010505e437181fe606ff721d3ddffd2fba33bbc328e5f87bb117b91d5fde65004ff71b0964fa27

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads