5e413395022f7ef850a8afe988b5adbf29b6266ff8a64344d6d9138c2b53c009

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202d5157af744a39a09c25c1b94df7cf.exe
Size

24KB
MD5

202d5157af744a39a09c25c1b94df7cf
SHA1

b692c3a1f8567e43f20c9fdb8cd0fcb9a32b8c07
SHA256

5e413395022f7ef850a8afe988b5adbf29b6266ff8a64344d6d9138c2b53c009
SHA512

e4a84b9205926500fd2e996fd9d0366050062520f4102d2358d5f3d291dca1147ba0af7e01408fcf5f51f0fb517b4b4709ac1eca7363c600406592402a437a96
SSDEEP

384:E3eVES+/xwGkRKJaflM61qmTTMVF9/q5nzJ0:bGS+ZfbJafO8qYoAa

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	202d5157af744a39a09c25c1b94df7cf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	202d5157af744a39a09c25c1b94df7cf.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3064	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2940	ipconfig.exe
2736	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	2736	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	202d5157af744a39a09c25c1b94df7cf.exe
2088	202d5157af744a39a09c25c1b94df7cf.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2176	2088	202d5157af744a39a09c25c1b94df7cf.exe	28
PID 2088 wrote to memory of 2176	2088	202d5157af744a39a09c25c1b94df7cf.exe	28
PID 2088 wrote to memory of 2176	2088	202d5157af744a39a09c25c1b94df7cf.exe	28
PID 2088 wrote to memory of 2176	2088	202d5157af744a39a09c25c1b94df7cf.exe	28
PID 2176 wrote to memory of 1656	2176	cmd.exe	30
PID 2176 wrote to memory of 1656	2176	cmd.exe	30
PID 2176 wrote to memory of 1656	2176	cmd.exe	30
PID 2176 wrote to memory of 1656	2176	cmd.exe	30
PID 2176 wrote to memory of 2940	2176	cmd.exe	31
PID 2176 wrote to memory of 2940	2176	cmd.exe	31
PID 2176 wrote to memory of 2940	2176	cmd.exe	31
PID 2176 wrote to memory of 2940	2176	cmd.exe	31
PID 2176 wrote to memory of 3064	2176	cmd.exe	32
PID 2176 wrote to memory of 3064	2176	cmd.exe	32
PID 2176 wrote to memory of 3064	2176	cmd.exe	32
PID 2176 wrote to memory of 3064	2176	cmd.exe	32
PID 2176 wrote to memory of 2640	2176	cmd.exe	34
PID 2176 wrote to memory of 2640	2176	cmd.exe	34
PID 2176 wrote to memory of 2640	2176	cmd.exe	34
PID 2176 wrote to memory of 2640	2176	cmd.exe	34
PID 2640 wrote to memory of 2644	2640	net.exe	35
PID 2640 wrote to memory of 2644	2640	net.exe	35
PID 2640 wrote to memory of 2644	2640	net.exe	35
PID 2640 wrote to memory of 2644	2640	net.exe	35
PID 2176 wrote to memory of 2736	2176	cmd.exe	36
PID 2176 wrote to memory of 2736	2176	cmd.exe	36
PID 2176 wrote to memory of 2736	2176	cmd.exe	36
PID 2176 wrote to memory of 2736	2176	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\202d5157af744a39a09c25c1b94df7cf.exe
"C:\Users\Admin\AppData\Local\Temp\202d5157af744a39a09c25c1b94df7cf.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2644
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
b69cccc4b602a58deb57530bab43d3b0

SHA1
0c20570984008452e1f95dc3744d56ed8d3b617a

SHA256
fbb250de359330438d4d4bef1668b3beef22c86b902759f76129a3a4421524fd

SHA512
a9cc2d27609c248209bc32a8d0cfe541979cd90b9800444342c979c8862ff1c46e89571589e0e2aab4dae9532637761ecfd67ab2022b50aed635902919266fe5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads