ecf4b07c9f7ab1015e410c7b97e634b052b86fddf7d057dba6c0753dfac98d85

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0240ac620a27ae1111ea8b0b503251b9.exe
Size

24KB
MD5

0240ac620a27ae1111ea8b0b503251b9
SHA1

c317e93879be45c81bee1fbc14ae18a42a4984e8
SHA256

ecf4b07c9f7ab1015e410c7b97e634b052b86fddf7d057dba6c0753dfac98d85
SHA512

d2f34600b4b498e8b50c67474080fdb3642371df5ecd1f08716e60ccdc92c2240750d203df95f332500b045b19136e0c58fa0348e35e7af2a9165235b896d8f5
SSDEEP

384:E3eVES+/xwGkRKJBv4GlM61qmTTMVF9/q5Ru0:bGS+ZfbJRO8qYoARH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	0240ac620a27ae1111ea8b0b503251b9.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	0240ac620a27ae1111ea8b0b503251b9.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2876	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2268	ipconfig.exe
1480	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	tasklist.exe
Token: SeDebugPrivilege	1480	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2024	0240ac620a27ae1111ea8b0b503251b9.exe
2024	0240ac620a27ae1111ea8b0b503251b9.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1932	2024	0240ac620a27ae1111ea8b0b503251b9.exe	28
PID 2024 wrote to memory of 1932	2024	0240ac620a27ae1111ea8b0b503251b9.exe	28
PID 2024 wrote to memory of 1932	2024	0240ac620a27ae1111ea8b0b503251b9.exe	28
PID 2024 wrote to memory of 1932	2024	0240ac620a27ae1111ea8b0b503251b9.exe	28
PID 1932 wrote to memory of 2056	1932	cmd.exe	30
PID 1932 wrote to memory of 2056	1932	cmd.exe	30
PID 1932 wrote to memory of 2056	1932	cmd.exe	30
PID 1932 wrote to memory of 2056	1932	cmd.exe	30
PID 1932 wrote to memory of 2268	1932	cmd.exe	31
PID 1932 wrote to memory of 2268	1932	cmd.exe	31
PID 1932 wrote to memory of 2268	1932	cmd.exe	31
PID 1932 wrote to memory of 2268	1932	cmd.exe	31
PID 1932 wrote to memory of 2876	1932	cmd.exe	32
PID 1932 wrote to memory of 2876	1932	cmd.exe	32
PID 1932 wrote to memory of 2876	1932	cmd.exe	32
PID 1932 wrote to memory of 2876	1932	cmd.exe	32
PID 1932 wrote to memory of 2624	1932	cmd.exe	34
PID 1932 wrote to memory of 2624	1932	cmd.exe	34
PID 1932 wrote to memory of 2624	1932	cmd.exe	34
PID 1932 wrote to memory of 2624	1932	cmd.exe	34
PID 2624 wrote to memory of 2616	2624	net.exe	35
PID 2624 wrote to memory of 2616	2624	net.exe	35
PID 2624 wrote to memory of 2616	2624	net.exe	35
PID 2624 wrote to memory of 2616	2624	net.exe	35
PID 1932 wrote to memory of 1480	1932	cmd.exe	36
PID 1932 wrote to memory of 1480	1932	cmd.exe	36
PID 1932 wrote to memory of 1480	1932	cmd.exe	36
PID 1932 wrote to memory of 1480	1932	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\0240ac620a27ae1111ea8b0b503251b9.exe
"C:\Users\Admin\AppData\Local\Temp\0240ac620a27ae1111ea8b0b503251b9.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2616
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
33d3eac2ea32fa7b2506667a918775f3

SHA1
8c6a7dc976b5cd8eee88cb55e3b7d5f80c1671a2

SHA256
c88e034a6052d29f65fa94b1fb7ea186679bdeeebed9e6502154f8c8135f9309

SHA512
15833be569cd276d53f248f95cb15d1cfa4777716db291d472a4f6b438593949383477e1fab3e166df04c8221b6db44d5697a4e019ca569cb66fda1b39238e9d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads