ecf4b07c9f7ab1015e410c7b97e634b052b86fddf7d057dba6c0753dfac98d85

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0240ac620a27ae1111ea8b0b503251b9.exe
Size

24KB
MD5

0240ac620a27ae1111ea8b0b503251b9
SHA1

c317e93879be45c81bee1fbc14ae18a42a4984e8
SHA256

ecf4b07c9f7ab1015e410c7b97e634b052b86fddf7d057dba6c0753dfac98d85
SHA512

d2f34600b4b498e8b50c67474080fdb3642371df5ecd1f08716e60ccdc92c2240750d203df95f332500b045b19136e0c58fa0348e35e7af2a9165235b896d8f5
SSDEEP

384:E3eVES+/xwGkRKJBv4GlM61qmTTMVF9/q5Ru0:bGS+ZfbJRO8qYoARH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	0240ac620a27ae1111ea8b0b503251b9.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	0240ac620a27ae1111ea8b0b503251b9.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2212	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1936	ipconfig.exe
5020	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	5020	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3208	0240ac620a27ae1111ea8b0b503251b9.exe
3208	0240ac620a27ae1111ea8b0b503251b9.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2512	3208	0240ac620a27ae1111ea8b0b503251b9.exe	86
PID 3208 wrote to memory of 2512	3208	0240ac620a27ae1111ea8b0b503251b9.exe	86
PID 3208 wrote to memory of 2512	3208	0240ac620a27ae1111ea8b0b503251b9.exe	86
PID 2512 wrote to memory of 1852	2512	cmd.exe	88
PID 2512 wrote to memory of 1852	2512	cmd.exe	88
PID 2512 wrote to memory of 1852	2512	cmd.exe	88
PID 2512 wrote to memory of 1936	2512	cmd.exe	89
PID 2512 wrote to memory of 1936	2512	cmd.exe	89
PID 2512 wrote to memory of 1936	2512	cmd.exe	89
PID 2512 wrote to memory of 2212	2512	cmd.exe	90
PID 2512 wrote to memory of 2212	2512	cmd.exe	90
PID 2512 wrote to memory of 2212	2512	cmd.exe	90
PID 2512 wrote to memory of 4988	2512	cmd.exe	93
PID 2512 wrote to memory of 4988	2512	cmd.exe	93
PID 2512 wrote to memory of 4988	2512	cmd.exe	93
PID 4988 wrote to memory of 4648	4988	net.exe	95
PID 4988 wrote to memory of 4648	4988	net.exe	95
PID 4988 wrote to memory of 4648	4988	net.exe	95
PID 2512 wrote to memory of 5020	2512	cmd.exe	96
PID 2512 wrote to memory of 5020	2512	cmd.exe	96
PID 2512 wrote to memory of 5020	2512	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\0240ac620a27ae1111ea8b0b503251b9.exe
"C:\Users\Admin\AppData\Local\Temp\0240ac620a27ae1111ea8b0b503251b9.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1936
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:4648
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
4c76b1c62293ee5ec71737da392c1dbd

SHA1
4bf5ea6d9fd37cab325550fb3d54d0c70e749879

SHA256
c96c2d64dd4426a4fcbe5052b20f5e2ad2fb952e647ba2f62c3fd33a557335d1

SHA512
96fc428d67ed91ea1fd72b4688d009ca741429af71e64c952da324f9672f0899cb7310f2754912143d557a1472f779a5c487edc7f44fde785c5110e0f8e07edc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads