5e413395022f7ef850a8afe988b5adbf29b6266ff8a64344d6d9138c2b53c009

Analysis

max time kernel
157s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:34

Target

202d5157af744a39a09c25c1b94df7cf.exe
Size

24KB
MD5

202d5157af744a39a09c25c1b94df7cf
SHA1

b692c3a1f8567e43f20c9fdb8cd0fcb9a32b8c07
SHA256

5e413395022f7ef850a8afe988b5adbf29b6266ff8a64344d6d9138c2b53c009
SHA512

e4a84b9205926500fd2e996fd9d0366050062520f4102d2358d5f3d291dca1147ba0af7e01408fcf5f51f0fb517b4b4709ac1eca7363c600406592402a437a96
SSDEEP

384:E3eVES+/xwGkRKJaflM61qmTTMVF9/q5nzJ0:bGS+ZfbJafO8qYoAa

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	202d5157af744a39a09c25c1b94df7cf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	202d5157af744a39a09c25c1b94df7cf.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
1628	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
2716	ipconfig.exe
4964	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	4964	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	202d5157af744a39a09c25c1b94df7cf.exe
2220	202d5157af744a39a09c25c1b94df7cf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 676	2220	202d5157af744a39a09c25c1b94df7cf.exe	93
PID 2220 wrote to memory of 676	2220	202d5157af744a39a09c25c1b94df7cf.exe	93
PID 2220 wrote to memory of 676	2220	202d5157af744a39a09c25c1b94df7cf.exe	93
PID 676 wrote to memory of 1224	676	cmd.exe	95
PID 676 wrote to memory of 1224	676	cmd.exe	95
PID 676 wrote to memory of 1224	676	cmd.exe	95
PID 676 wrote to memory of 2716	676	cmd.exe	96
PID 676 wrote to memory of 2716	676	cmd.exe	96
PID 676 wrote to memory of 2716	676	cmd.exe	96
PID 676 wrote to memory of 1628	676	cmd.exe	98
PID 676 wrote to memory of 1628	676	cmd.exe	98
PID 676 wrote to memory of 1628	676	cmd.exe	98
PID 676 wrote to memory of 4840	676	cmd.exe	101
PID 676 wrote to memory of 4840	676	cmd.exe	101
PID 676 wrote to memory of 4840	676	cmd.exe	101
PID 4840 wrote to memory of 1852	4840	net.exe	102
PID 4840 wrote to memory of 1852	4840	net.exe	102
PID 4840 wrote to memory of 1852	4840	net.exe	102
PID 676 wrote to memory of 4964	676	cmd.exe	103
PID 676 wrote to memory of 4964	676	cmd.exe	103
PID 676 wrote to memory of 4964	676	cmd.exe	103