88a5e4d13b31864b76eebf50118e1aa4c0d57cbcd7463eef73685b18c8d4c77a

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:24

Target

6e44fe1424a9e32b2c5cf0bc56489f32.exe
Size

24KB
MD5

6e44fe1424a9e32b2c5cf0bc56489f32
SHA1

25806965bce207c85a4b212802de768225959c34
SHA256

88a5e4d13b31864b76eebf50118e1aa4c0d57cbcd7463eef73685b18c8d4c77a
SHA512

aa1a8480100f9c3e48ea818bcab52c71266ffafff0ea24ab2a293f63b3960dc6d1d80f3bffa4e3ff49543fc5f2599a331f2fb676d9374759fc135236a228b554
SSDEEP

384:E3eVES+/xwGkRKJPbHUllM61qmTTMVF9/q5w0:bGS+ZfbJjHKO8qYoAJ

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	6e44fe1424a9e32b2c5cf0bc56489f32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	6e44fe1424a9e32b2c5cf0bc56489f32.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2548	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
2352	ipconfig.exe
2688	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	tasklist.exe
Token: SeDebugPrivilege	2688	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2216	6e44fe1424a9e32b2c5cf0bc56489f32.exe
2216	6e44fe1424a9e32b2c5cf0bc56489f32.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1068	2216	6e44fe1424a9e32b2c5cf0bc56489f32.exe	16
PID 2216 wrote to memory of 1068	2216	6e44fe1424a9e32b2c5cf0bc56489f32.exe	16
PID 2216 wrote to memory of 1068	2216	6e44fe1424a9e32b2c5cf0bc56489f32.exe	16
PID 2216 wrote to memory of 1068	2216	6e44fe1424a9e32b2c5cf0bc56489f32.exe	16
PID 1068 wrote to memory of 2344	1068	cmd.exe	23
PID 1068 wrote to memory of 2344	1068	cmd.exe	23
PID 1068 wrote to memory of 2344	1068	cmd.exe	23
PID 1068 wrote to memory of 2344	1068	cmd.exe	23
PID 1068 wrote to memory of 2352	1068	cmd.exe	17
PID 1068 wrote to memory of 2352	1068	cmd.exe	17
PID 1068 wrote to memory of 2352	1068	cmd.exe	17
PID 1068 wrote to memory of 2352	1068	cmd.exe	17
PID 1068 wrote to memory of 2548	1068	cmd.exe	18
PID 1068 wrote to memory of 2548	1068	cmd.exe	18
PID 1068 wrote to memory of 2548	1068	cmd.exe	18
PID 1068 wrote to memory of 2548	1068	cmd.exe	18
PID 1068 wrote to memory of 2612	1068	cmd.exe	22
PID 1068 wrote to memory of 2612	1068	cmd.exe	22
PID 1068 wrote to memory of 2612	1068	cmd.exe	22
PID 1068 wrote to memory of 2612	1068	cmd.exe	22
PID 2612 wrote to memory of 2652	2612	net.exe	21
PID 2612 wrote to memory of 2652	2612	net.exe	21
PID 2612 wrote to memory of 2652	2612	net.exe	21
PID 2612 wrote to memory of 2652	2612	net.exe	21
PID 1068 wrote to memory of 2688	1068	cmd.exe	20
PID 1068 wrote to memory of 2688	1068	cmd.exe	20
PID 1068 wrote to memory of 2688	1068	cmd.exe	20
PID 1068 wrote to memory of 2688	1068	cmd.exe	20