77a653ca6a0f58d12999d7658dc107fe4020f12b47f9e170c13da7602fe5d11e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fe0de0929ad8ed772bc695dab6ce968.exe
Size

24KB
MD5

0fe0de0929ad8ed772bc695dab6ce968
SHA1

10ad2177e8a3a646560fce0b778eab466107ffb0
SHA256

77a653ca6a0f58d12999d7658dc107fe4020f12b47f9e170c13da7602fe5d11e
SHA512

84bed1c2803a9c7a8be1f712e638133b65c84a7a0502e77abc881295ef9f7ddc3e85ed14cf525d7e1c961dc1057cf0d168a30c78fcf04a3dd61ce229e8a12784
SSDEEP

384:E3eVES+/xwGkRKJEI6b7lM61qmTTMVF9/q5C0:bGS+ZfbJ96XO8qYoAD

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	0fe0de0929ad8ed772bc695dab6ce968.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	0fe0de0929ad8ed772bc695dab6ce968.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4940	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5016	ipconfig.exe
4396	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	tasklist.exe
Token: SeDebugPrivilege	4396	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3196	0fe0de0929ad8ed772bc695dab6ce968.exe
3196	0fe0de0929ad8ed772bc695dab6ce968.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 2920	3196	0fe0de0929ad8ed772bc695dab6ce968.exe	88
PID 3196 wrote to memory of 2920	3196	0fe0de0929ad8ed772bc695dab6ce968.exe	88
PID 3196 wrote to memory of 2920	3196	0fe0de0929ad8ed772bc695dab6ce968.exe	88
PID 2920 wrote to memory of 1996	2920	cmd.exe	90
PID 2920 wrote to memory of 1996	2920	cmd.exe	90
PID 2920 wrote to memory of 1996	2920	cmd.exe	90
PID 2920 wrote to memory of 5016	2920	cmd.exe	91
PID 2920 wrote to memory of 5016	2920	cmd.exe	91
PID 2920 wrote to memory of 5016	2920	cmd.exe	91
PID 2920 wrote to memory of 4940	2920	cmd.exe	92
PID 2920 wrote to memory of 4940	2920	cmd.exe	92
PID 2920 wrote to memory of 4940	2920	cmd.exe	92
PID 2920 wrote to memory of 4676	2920	cmd.exe	95
PID 2920 wrote to memory of 4676	2920	cmd.exe	95
PID 2920 wrote to memory of 4676	2920	cmd.exe	95
PID 4676 wrote to memory of 3732	4676	net.exe	96
PID 4676 wrote to memory of 3732	4676	net.exe	96
PID 4676 wrote to memory of 3732	4676	net.exe	96
PID 2920 wrote to memory of 4396	2920	cmd.exe	97
PID 2920 wrote to memory of 4396	2920	cmd.exe	97
PID 2920 wrote to memory of 4396	2920	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\0fe0de0929ad8ed772bc695dab6ce968.exe
"C:\Users\Admin\AppData\Local\Temp\0fe0de0929ad8ed772bc695dab6ce968.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5016
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:3732
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
e1c2315ada8656dfb5893154085bd933

SHA1
da2931de7d1028c832979e57204f75583782257c

SHA256
b7f72ae2c3f96cc4d3eea502a655b87ea8e65c381473b7acf7260c6ff9214ca4

SHA512
fdb4fb9cb922af38d11a34496c92efdf069241eff94c9174cea22d29ca17b2077066c24c2eccc97436b66be01aa72ea26ebdf5339da9fc026392ae568dc202c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads