47e23a6c8ab938ad4f7a2c1f297df4b4bf7f154dffa66ba8b60d6dcfff3c886d

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10132d74c3894c3df882c9dedbca050b.exe
Size

24KB
MD5

10132d74c3894c3df882c9dedbca050b
SHA1

28c7f76cd5bccec1f1ca43b073c9b32b34e0cbc3
SHA256

47e23a6c8ab938ad4f7a2c1f297df4b4bf7f154dffa66ba8b60d6dcfff3c886d
SHA512

2563f6caa2de1c21b2d4ac587530e7b76584c2fb1ed4fd7f6fe1307c28409b40a87cc3854f17df5d71d722f9503df50f93122eca2587d8e777f417381f47d46a
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5P0:bGS+ZfbJiO8qYoAs

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	10132d74c3894c3df882c9dedbca050b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	10132d74c3894c3df882c9dedbca050b.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2952	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2676	NETSTAT.EXE
2376	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	tasklist.exe
Token: SeDebugPrivilege	2676	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	10132d74c3894c3df882c9dedbca050b.exe
2656	10132d74c3894c3df882c9dedbca050b.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2324	2656	10132d74c3894c3df882c9dedbca050b.exe	25
PID 2656 wrote to memory of 2324	2656	10132d74c3894c3df882c9dedbca050b.exe	25
PID 2656 wrote to memory of 2324	2656	10132d74c3894c3df882c9dedbca050b.exe	25
PID 2656 wrote to memory of 2324	2656	10132d74c3894c3df882c9dedbca050b.exe	25
PID 2324 wrote to memory of 2384	2324	cmd.exe	17
PID 2324 wrote to memory of 2384	2324	cmd.exe	17
PID 2324 wrote to memory of 2384	2324	cmd.exe	17
PID 2324 wrote to memory of 2384	2324	cmd.exe	17
PID 2324 wrote to memory of 2376	2324	cmd.exe	23
PID 2324 wrote to memory of 2376	2324	cmd.exe	23
PID 2324 wrote to memory of 2376	2324	cmd.exe	23
PID 2324 wrote to memory of 2376	2324	cmd.exe	23
PID 2324 wrote to memory of 2952	2324	cmd.exe	18
PID 2324 wrote to memory of 2952	2324	cmd.exe	18
PID 2324 wrote to memory of 2952	2324	cmd.exe	18
PID 2324 wrote to memory of 2952	2324	cmd.exe	18
PID 2324 wrote to memory of 2600	2324	cmd.exe	22
PID 2324 wrote to memory of 2600	2324	cmd.exe	22
PID 2324 wrote to memory of 2600	2324	cmd.exe	22
PID 2324 wrote to memory of 2600	2324	cmd.exe	22
PID 2600 wrote to memory of 2588	2600	net.exe	20
PID 2600 wrote to memory of 2588	2600	net.exe	20
PID 2600 wrote to memory of 2588	2600	net.exe	20
PID 2600 wrote to memory of 2588	2600	net.exe	20
PID 2324 wrote to memory of 2676	2324	cmd.exe	21
PID 2324 wrote to memory of 2676	2324	cmd.exe	21
PID 2324 wrote to memory of 2676	2324	cmd.exe	21
PID 2324 wrote to memory of 2676	2324	cmd.exe	21

C:\Users\Admin\AppData\Local\Temp\10132d74c3894c3df882c9dedbca050b.exe
"C:\Users\Admin\AppData\Local\Temp\10132d74c3894c3df882c9dedbca050b.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd /c set
1⤵
PID:2384

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start
1⤵
PID:2588

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -an
1⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\SysWOW64\net.exe
net start
1⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
1⤵
- Gathers network information
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
5b7bab8639627c9d24096e7ebf88ebf8

SHA1
947b16cbd96b2ec9b05660b15deae57b3a117498

SHA256
0e899a812cf55b566d692c2e3625459f3230453453a75fcd3589df403b4250e6

SHA512
06ac978f895cdaded550c92553032ec0336307dc3b21acad602bad59bd3ef28a865aa875e71a8b76486e3155d4e8e2924b7d8bf4eaeef77eb2fed95096fc58c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads